Claude Code's 'don't ask again' leaked 2,539 GitHub secrets

Security firm Apiiro counted 2,539 distinct secrets exposed across 1,994 public GitHub repositories, all leaking through a single convenience toggle in Anthropic's Claude Code, as Ars Technica reported.

The mechanism is the "Yes, and don't ask again" popup. When a developer approves a Claude Code command that embeds a credential, the exact string gets saved as an allow rule in `.claude/settings.local.json` inside the project folder. If that folder later becomes a git repository, or already was one, the settings file rides along into commits.

Apiiro's team examined 104,185 public copies of that file between November 1 and 3, 2026. 1,122 of them held real secrets: 1,379 distinct credentials, including 379 database passwords, 122 Supabase service-role keys, 43 SSH logins, 42 GitHub, GitLab and npm tokens, and 23 AWS keys. The researchers describe finding "a database vendor's admin-level cloud key, a production Azure PostgreSQL password, a Square production token, and the owner password for a medical-records database."

Claude Code does try to protect users by adding the file to a global git-ignore list. Per Apiiro's writeup, that safeguard "does not travel with the project, cover files already tracked, or reliably protect a folder turned into a repository later."

Boris Cherny, head of Claude Code, replied on Hacker News: "we are looking into what we can do to prevent this."

Standard secret scanners missed a meaningful chunk of the damage. Of the 1,122 affected files, Gitleaks flagged 564 and TruffleHog flagged 643. Neither tool flagged 215 of them. 63 organizations are affected alongside individual developers.