Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub

What happened

Anthropic's Claude Code AI assistant saves shell commands that users approve, including any passwords or API keys entered, in a local settings file called .claude/settings.local.json. Security researchers found that this file, containing sensitive information, is publicly accessible in 1,122 GitHub repositories. Even if the file is deleted from a project, the secrets can remain in the repository's history and in forks. The researchers advised developers to rotate all credentials found in these files and to clean up exposed secrets immediately.

Key details

• 1,122 public GitHub repositories contain .claude/settings.local.json files with at least one secret.
• A total of 1,379 unique secrets were found, including 379 database passwords, 43 SSH logins, and 23 AWS keys.
• 63 organizations, mostly software companies, own affected repositories.
• Claude Code saves the full approved command, including secrets, when users select 'Yes, and don't ask again.'
• Claude Code does not add the file to the project's .gitignore, so it can be committed and shared by accident.

Why it matters

Developers and organizations using Claude Code face the risk of having their passwords, tokens, and keys exposed publicly, which could lead to unauthorized access to databases, servers, and cloud services. They now need to rotate all affected credentials and ensure these files are removed from both current and historical versions of their repositories. Security teams must update their scanning processes to detect and handle these files to prevent future leaks.