A recent discovery by Apiiro researchers reveals a significant security risk associated with Claude Code’s “Yes, and don’t ask again” option. This feature can inadvertently store passwords and API keys within project settings, which may later become public when pushed to GitHub repositories.
Research Findings Highlight Exposure
Apiiro’s investigation uncovered 2,539 unique secrets across 1,994 public repositories, emphasizing how a simple user approval can transform sensitive credentials into publicly accessible data. This breach affected 63 organizations, predominantly in the software sector. Among the exposed credentials were a cloud key for a database vendor, a production Azure PostgreSQL password, a Square production token, and a medical records database owner password. One enterprise confirmed the live status of its compromised key.
The vulnerability emerges during standard development tasks. A developer might request Claude Code to execute a database check, test an API, or resolve a login issue. Claude Code then formulates a shell command containing a credential from a configuration file, seeking permission before proceeding. Opting for “Yes, and don’t ask again” saves this command, with its secrets, in .claude/settings.local.json, allowing future executions without further prompts. The threat arises when this local file is committed to GitHub.
Mechanisms and Limitations of Claude Code
Claude Code attempts to mitigate this risk by adding an exclusion to the developer’s global Git ignore file upon first writing the file in a Git repository. However, this protection doesn’t accompany the project, cover pre-existing files, or secure folders later converted into repositories.
Apiiro’s analysis of 104,185 public copies of .claude/settings.local.json files revealed 1,122 containing real secrets, totaling 1,379 distinct credentials. Through earlier commits, shared settings, and agent transcripts, the total increased to 2,539. This data was collected from November 1-3, 2026.
Mitigation Strategies and Recommendations
Apiiro’s findings indicate databases account for a significant portion of exposed access, with 379 database passwords and 122 Supabase service-role keys among the discoveries. Additional exposed credentials include cloud access keys, private keys, package-registry tokens, and 43 SSH logins, some with root passwords.
Standard scanning tools like Gitleaks and TruffleHog failed to detect all vulnerabilities. Of the affected local settings files, Gitleaks flagged 564, while TruffleHog flagged 643, leaving 215 files undetected. Passwords embedded in formats like PGPASSWORD=, sshpass -p, or within request headers often escape detection.
To mitigate these risks, developers should thoroughly search their files and Git history for .claude/settings.local.json and inspect shared .claude/settings.json files. An examination of allow rules for passwords, tokens, connection strings, and authorization headers is recommended. Apiiro also noted the presence of secrets in saved agent conversations, memory files, and deployment notes.
Immediate actions include rotating exposed credentials before file removal or history rewriting. Developers should untrack local settings using git rm –cached .claude/settings.local.json and add the path to the repository’s .gitignore. Utilizing secret-manager references instead of literal passwords in commands is advised. Security teams should scan agent folders and history for command-embedded passwords and recognizable API keys.
