Anthropic’s Claude Code has a serious security flaw: its “Yes, and don’t ask again” setting saves the entire shell command—including any passwords or API keys used—in a file that can be publicly committed to GitHub. A recent analysis found 1,122 live copies of this file holding at least one secret token or password. Removal of the file doesn’t fully fix the issue, because older versions persist in git history and in forks.
What’s Going Wrong
When you tell Claude Code to “Yes, and don’t ask again” for a shell command, the assistant creates an allow rule in .claude/settings.local.json. If that command includes your password or token typed inline, it gets stored verbatim in that project file. While Claude attempts to add the file to the user’s global git exclude list (to prevent commits within that user’s local machine), it never modifies the project’s own .gitignore. So once committed—even accidentally—the secret becomes part of the project’s public history.
Scope of the Exposure
Security firm Apiiro scoured public GitHub for copies of .claude/settings.local.json and discovered over 104,000 instances across more than 103,000 repositories. Of those, 1,122 contained at least one secret, totaling 1,379 unique secrets. These include 379 database passwords, 43 SSH credentials for servers, 42 tokens for GitHub, GitLab or npm, and 23 AWS access keys.
Organizations ranging from small dev shops to large software companies were affected—63 orgs in all. Alarming cases include an administrator-level cloud key from a database vendor and the owner password for a medical records database. Many of these files remained in default branches, and half of those exposed had been there for 217 days or more. Forks and historical versions expanded the spread.
Detection Issues and How Attackers Could Exploit It
Even fairly comprehensive secret-scanning tools missed many of these exposures. Tools like TruffleHog and gitleaks flagged around half or more of the problem files—but ignored others where commands included inline secrets. Scanners tend to detect only known key formats or standard patterns, failing to catch passwords embedded in commands or rules.
What Can Developers Do
Experts recommend the following remediation steps:
- Search your organizations for both
.claude/settings.local.jsonand.claude/settings.json, checking git history to find files that may have been deleted but still leak secrets. - Rotate all exposed credentials—passwords, keys, tokens—immediately before trying to clean up.
- Ensure that
settings.local.jsonis removed from tracking (git rm --cached) and added to.gitignoreat the project level. - Delete any allow rule that includes a secret, even from local files that were never committed.
- Use variables from secrets managers in commands, rather than putting secrets inline. Approve patterns (wildcard or regex style) instead of exact commands where possible.
- Be aware that secrets might still be included via builds, packages, archives, synced folders, or Docker images.
Apiiro also advises treating agent folders (.claude, .cursor, .gemini, etc.) and agent memory files with the same care as environment files (.env) during audits, and integrating secret scanning into CI and pre-commit hooks. Make sure scanners search not only key formats, but also look inside commands for credentials.
Anthropic’s Response so Far
This behavior has been reported previously, with bug filings dating back as far as August 2025. These reports flagged the storage of API keys and tokens in full approved commands in settings.local.json. To date, the bug-tracker shows reports closed without a response from Anthropic, usually by automated bot actions. The most recent such closure happened just yesterday.
This exposure is significant. Secrets stored in plain text anywhere publicly accessible are a high-risk breach. Projects of all sizes could be compromised—especially those with database or cloud-access credentials. While this issue stems from Claude Code, it reflects a broader risk in AI-assisted development: automations that save command history or permissions can inadvertently leak credentials.
