The convenience of Claude Code's "Yes, and don't ask again" feature has created a significant security blind spot for developers using Anthropic's coding agent. Researchers Shmulik Cohen and Matan Giladi from Apiiro discovered that when users approve a shell command containing a hardcoded secret, the agent writes the entire command, including the credential, into .claude/settings.local.json. This file, intended to streamline local permissions, often ends up committed to public repositories, exposing sensitive data to the world.

The Scale of the Leak

Between November 1 and 3, the Apiiro team scanned GitHub and identified 104,185 public copies of the settings.local.json file. Of those, 1,122 files contained at least one secret, totaling 1,379 distinct exposed values. The breakdown is alarming: 379 database passwords, 43 SSH logins for publicly reachable servers, 42 tokens for GitHub, GitLab, and npm, and 122 Supabase service-role keys. The researchers noted that these secrets were still present on default branches, with some files having been exposed for over 217 days.

Why Standard Scanners Failed

A critical finding is that traditional secret scanners like gitleaks and TruffleHog missed a significant portion of these exposures. When tested against the discovered files, gitleaks flagged only 564 of the 1,122 leaking files, while TruffleHog caught 643. A total of 215 files were missed by both tools. The failure occurs because scanners typically look for known key formats or high-entropy strings, but passwords embedded in standard command-line flags (e.g., PGPASSWORD=hunter2) often appear as ordinary words, bypassing detection logic.

The Commit Problem

The issue is compounded by how Claude Code handles the file itself. While the agent attempts to add the file to global git excludes, this protection does not travel with the repository. If the file is already tracked, or if the global exclude fails, the agent may commit the changes. Apiiro found that in 539 of the 1,105 repositories traced, commits authored by Claude were responsible for changing the settings file, effectively the agent committing its own leaked secrets.

Remediation and Best Practices

Deleting the file from the current directory does not remove the secret from git history or forks. Apiiro recommends a strict order of operations: rotate credentials first, then clean up the repository history using tools like git-filter-repo or BFG. To prevent future leaks, developers should avoid hardcoding secrets in commands, instead using environment variables (e.g., psql "$DB_URL"). Additionally, approving permission patterns (e.g., Bash(npm run:*)) rather than exact commands ensures that the saved rules do not capture specific, sensitive arguments.

Key Takeaways

  • Claude Code's 'don't ask again' feature saves full command strings, including hardcoded secrets, to .claude/settings.local.json.
  • 1,379 distinct secrets were found in 1,122 public GitHub repositories, including database passwords and API keys.
  • Standard secret scanners like gitleaks and TruffleHog missed roughly one-third of the exposed files.
  • Developers should use environment variables and pattern-based permissions to avoid storing credentials in plain text.

The Bottom Line

Claude Code's permission system is too literal; it remembers exactly what you typed, not just what you meant to allow. Until Anthropic patches this to strip arguments or default to pattern matching, treat every 'don't ask again' click on a command with a secret as a potential credential leak.