Claude Code's Don't Ask Again Settings Can Expose Passwords on GitHub

Your password can reach public GitHub if you commit Claude Code's "Yes, and don't ask again" settings. Apiiro's November 5, 2026 report traces how an approved command becomes a saved permission rule, password included.

What happens when you click the button

Claude Code's settings docs say choosing "Yes, and don't ask again" saves the approval as an allow rule in .claude/settings.local.json. Apiiro found that the rule records the exact command. If that command contains a password, the saved rule contains it too.

Claude Code adds the file to your global git ignore when it first creates it in a git repo that doesn't already ignore it. Apiiro describes gaps: a folder becomes a repo later, a clone lives on another machine, or the file was already committed. The rule doesn't go into the repo's own .gitignore.

What Apiiro found

Apiiro's November 1-3 GitHub scan found 104,185 public copies of the settings file. It classified 1,122 as holding real secrets: credentials matching a provider format, or passwords and tokens alongside a public host.

That definition has limits. Apiiro didn't use or test credentials and didn't contact hosts. A match doesn't establish that a credential still works.

In 539 of the 1,105 affected repos it traced, Apiiro found a Claude co-authored commit changed the file. It also found 734 secrets in older versions that appeared in no current copy, across 509 repos. Removing the current file leaves that history behind.

Why scanners miss it

Apiiro ran gitleaks and TruffleHog over all 104,185 files. Of the 1,122 files with a real secret, they flagged 564 and 643 respectively. Both missed 215 files.

Apiiro says passwords after PGPASSWORD=, sshpass -p or mysql -p can look like ordinary words inside ordinary commands. Bearer headers in curl calls can pass too. A scanner check needs to cover those command shapes.

What Anthropic says

On Hacker News on November 7, Claude Code lead Boris Cherny said the file is meant to stay local. He described the files as manually created and checked in. Apiiro's co-authored-commit finding and ignore-gap examples offer a different account of how they reached repos.

Cherny said Anthropic was looking into prevention and that he planned to prototype approaches including basic secret scanning and checking auto mode. He recommended auto mode and secret scanning. As of November 8, 2026, no fix for this had been announced in these sources.

How to check and fix yours

These steps come from Apiiro's "What to do" guidance:

1. Search your repos and GitHub organization for .claude/settings.local.json and .claude/settings.json. Include git history in secret scanning.
2. Rotate every credential the local settings file has ever held. Deletion leaves history, forks and clones.
3. Untrack the file with git rm --cached .claude/settings.local.json. Add .claude/settings.local.json to each repo's own .gitignore and organization templates.
4. Reference secrets through variables such as $DB_URL from your secrets manager. Approve command patterns such as Bash(npm run:*) instead of literal commands.
5. Add agent folders and memory files to pre-commit and CI secret scanning. Check that passwords inside commands and bearer headers get caught.

The builder angle (my opinion, no income guaranteed)

I'd package those steps as an agent-folder secrets cleanup for small dev teams: search settings and history, rotate exposed credentials, add ignore rules, and install a pre-commit command-password check. That's my service idea. The cleanup work comes from Apiiro's guidance.