Claude Code "don't ask again" approvals leaked 1,379 secrets to public GitHub
Researchers found that choosing "Yes, and don't ask again" in Claude Code saves the full approved shell command — including any embedded credential — in plaintext, in a file that Claude Code adds to the user's global gitignore when it first writes it. Scanning public copies, they found 1,379 distinct secrets, including 379 database passwords and 23 AWS keys.
📊 Scorecard: our Bearish call on $AMZN is scored from $259.30, the last close before it ran. Its first result comes after the next close.
The News
Apiiro researchers found that choosing "Yes, and don't ask again" in Claude Code saves the full approved shell command — including any embedded credential — in plaintext, in a file called .claude/settings.local.json. Claude Code does add the file to the user's global gitignore when it first writes it — but that protection does not travel with the project, does not cover files already tracked, and does not reliably protect a folder turned into a repository later, so the file can still be uploaded by accident, credentials and all.
Scanning 104,185 public copies of the file across 103,617 repositories between November 1 and 3, the researchers found 1,122 files holding 1,379 distinct secrets: 379 database passwords, 122 Supabase service-role keys, 43 SSH credentials and 23 AWS keys. Including git history and transcripts — the saved records of past sessions — they found 2,539 secrets across 1,994 repositories. One notified company confirmed its key was still live. The researchers did not test the credentials. The usual secret scanners largely missed the problem: Gitleaks flagged only 564 of the files and TruffleHog 643, because the secrets are embedded inside shell commands in a settings file, not sitting in code where scanners expect them.
The mechanism is the story, not just the count. Claude Code is an AI coding assistant that runs shell commands on a developer's behalf, and "don't ask again" is a convenience feature: approve once, never be asked again. The convenience quietly turned a credential into a file that travels with the project. Anthropic is the company behind Claude Code; Amazon and Google are its big investors and the public read-through. The research was published on November 5, with coverage on November 7–8.
Choosing 'don't ask again' saves the full approved command — including any embedded credential — in plaintext.
Why It Matters
The worst security failures are the ones that look like features. "Don't ask again" is a convenience every developer recognises — approve once, stop being interrupted — and it quietly saved credentials into a file that Git uploads by default. Nobody designed this leak; it fell out of two reasonable defaults meeting each other, and the result was 1,379 secrets in public, including live keys. That is how AI tools fail: not with a dramatic hack, but with a small design choice that nobody thought through.
That is why the verdict is Bearish. The fix is easy — exclude the file at the project level, warn before saving a credential — but the fact that it shipped at all, and that the scanners missed most of it, says the safety review for AI coding tools is still catching up with the tools themselves. Until the default changes, every developer who clicked "don't ask again" should assume their credentials are public and rotate them. The researchers did not test the credentials they found; one notified company confirmed its key was still live.
Analyst's Take
Our call is Bearish. The count — 1,379 secrets — is bad enough, but the mechanism is what should worry anyone building AI tools: a convenience feature quietly turned credentials into a file that travels with the project, and the usual safety nets missed it. One notified company confirmed its key was still live. The scanners that are supposed to catch exactly this kind of leak caught less than half the files, because the secrets were hiding somewhere new.
What to watch: whether Anthropic changes the default — excluding the file from Git at the project level, or warning before a credential is saved — and whether the count grows as more researchers scan. The read-through for Amazon and Google, Anthropic's investors, is that the safety of the AI tools they are betting on is still being worked out in public, one leaked credential at a time.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What is Claude Code?
An AI coding assistant from Anthropic that runs in the terminal — the text-based command line developers use — and can run shell commands on your behalf, like installing software or moving files. When it wants to run a command, it asks for permission first.
What does "don't ask again" actually do?
It saves the approved command so Claude Code never asks about that command again. The problem is where it saves it: the full command, including any password or key embedded in it, goes into a file called .claude/settings.local.json, in plain text — readable by anyone who can see the file.
Why did the secrets end up on public GitHub?
Because Claude Code only adds the file to the developer's own global gitignore — a list of files Git should never upload — when it first writes it. That protection lives on one machine: it does not travel with the project, does not cover files already tracked, and does not reliably protect a folder turned into a repository later, so the file can be uploaded by accident, credentials and all.
How many secrets did the researchers find?
Scanning 104,185 public copies of the file across 103,617 repositories between November 1 and 3, researchers at Apiiro found 1,122 files holding 1,379 distinct secrets: 379 database passwords, 122 Supabase service-role keys, 43 SSH credentials and 23 AWS keys. Including git history and transcripts, they found 2,539 secrets across 1,994 repositories. One notified company confirmed its key was still live. The researchers did not test the credentials.
Why didn't the usual secret scanners catch them?
Because the secrets are embedded inside shell commands in a settings file, not sitting in code where scanners expect them. Gitleaks flagged only 564 of the files and TruffleHog 643. The scanners are built for the usual places secrets hide; this was a new one.
👁
Source: Apiiro research via CyberSecurityNews / The Hacker News