Apiiro: Claude Code 'Don't Ask Again' Leaks Keys in 1,122 Repos
TL;DR
- The 'Don't Ask Again' approval stores the full shell command as a plaintext allow rule, capturing any credential embedded in that command.
- 215 of the 2,539 exposed secrets evaded both Trufflehog and GitHub Secret Scanning, leaving them undetected in live repositories.
- At least one confirmed live key was among the exposed credentials, moving the risk from theoretical to active production exposure.
Passwords and API keys developers typed into commands they approved inside Claude Code are sitting in public GitHub repositories, according to a report from software security company Apiiro covered by The Hacker News. When a user picks "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word including the secret, into a project settings file at `.claude/settings.local.json` — a path that is not gitignored by default.
Apiiro says it scanned 104,185 public copies of that file across 103,617 repositories. About 1.1% of them, or 1,122 copies, hold at least one secret. Together they hold 1,379 different secrets. The company did not test whether any still work.
The breakdown is specific: 379 database passwords, 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. Half of the affected repositories kept the file on their default branch for at least 217 days. Another 734 secrets turned up in older file versions across 509 repositories, deleted from the current tree but still readable in history, and 211 forks carried identical secrets copied from the original. Sixty-three organizations, mostly software companies, are affected. Apiiro notes that gitleaks flagged 564 of the files and TruffleHog detected 643; neither caught 215 of them.
The researchers compared documentation for 16 coding agents. "Claude Code is the only one confirmed to save the full approved command in a project file by default," the report says. That matters because the convenience toggle is the kind of thing a developer clicks once and forgets; the secret then ships to origin with the next commit.
Apiiro also says Anthropic's security intake has been quiet. "As of today, the four related reports the researchers cite have all been closed by the same bot, the most recent yesterday. None got a reply from Anthropic, they say." An earlier report from August was closed as "not planned" on January 3, after 60 days without activity. This is the second Claude Code disclosure we've tracked in a week, following a bug report alleging email leakage in the client's User-Agent header.
What others are reporting
-
Cyber Security News Read →
Frames the exposure as a design flaw in Claude Code's permission model, distinguishing it from prior vulnerabilities that required malicious prompts or adversarial exploitation.
Choosing 'Yes, and don't ask again' can store that command, including its secret, in `.claude/settings.local.json`.
-
iTWire Read →
Traces prior bug reports to August 2025 and examines the gap between Anthropic's intended gitignore guidance and its real-world enforcement across developer machines.
A credential used to do the work becomes part of the record that authorizes the work next time.
-
Security Arsenal Read →
Provides SIGMA detection rules, KQL Sentinel queries, and Velociraptor VQL artifacts alongside a 7-step incident response framework for immediate defender use.
Claude Code saves that command string to a project-level settings file so it can auto-approve the same command in future sessions.
-
Aviatrix Threat Research Read →
Maps the exposure to a MITRE ATT&CK kill chain and cross-references PCI DSS 4.0, HIPAA, DORA, NIS2, and NYDFS compliance implications for affected organizations.
A single 'don't ask again' click in Anthropic's AI coding assistant has left plaintext passwords exposed in over 1,100 repos.
-
Runtime Wire Read →
Explains why local .gitignore protections fail: the safeguard does not travel with code once committed to a shared repo.
A one-time approval in an AI coding agent became a persistent file containing the credential itself, committed often enough to expose production passwords at scale.
-
Bromure Read →
Vendor perspective using the finding to argue for encrypted stand-in credentials; confirms every one of the 1,379 secrets was a value the agent could actively type and use.
Every one of those 1,379 secrets was a value the agent could type.
Originally reported by thehackernews.com
Read the original article →Original headline: Apiiro Finds Claude Code's 'Don't Ask Again' Leaked 2,539 Secrets Across 1,994 Public GitHub Repos