# Claude Code 'Don't Ask Again' Exposes Secrets on GitHub > Anthropic's Claude Code feature, 'Yes, and don't ask again,' saves sensitive credentials like API keys and passwords in public GitHub repositories. - Published: 2026-11-07T14:31:17.000Z - Severity: high - Category: Data Breach - Tags: Anthropic, Claude Code, GitHub, API Keys, Data Exposure - Author: Runtime Rebel Intel - Primary source: https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html - Canonical: https://runtimerebel.com/blog/claude-code-don-t-ask-again-exposes-secrets-on-github ## Key points - Claude Code's 'Don't Ask Again' option publicly exposes passwords and API keys on GitHub, with over 1,100 repositories affected. - Affected systems include projects using Claude Code that saved commands containing sensitive credentials in `.claude/settings.local.json`. - Defenders must immediately rotate all potentially exposed credentials and enforce secure AI coding assistant configurations. Claude Code, Anthropic's [AI](/glossary#ai) coding assistant, contains a critical design flaw where its "Yes, and don't ask again" feature inadvertently stores sensitive credentials—including passwords, [API](/glossary#api) keys, and tokens—in plain text within project settings files. These files, named `.claude/settings.local.json`, are frequently committed to public GitHub repositories, making thousands of secrets accessible to anyone, as detailed by [Apiiro research](https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html). ## Technical Details of Claude Code Secret Exposure The exposure stems from Claude Code's functionality designed to streamline developer workflows. When a user approves a shell command and selects the "Yes, and don't ask again" option, the AI assistant saves the exact command in the `.claude/settings.local.json` file. If this command included sensitive information like a database password (e.g., `mysql -pYOURPASSWORD`) or an API token, that secret is saved verbatim, in plain text, within the project's local configuration. Apiiro's investigation revealed that 1,122 public copies of this file on GitHub hold at least one secret, totaling 1,379 distinct secrets. These include 379 database passwords, 43 [SSH](/glossary#secure-shell-ssh) logins for public servers, 42 tokens for platforms like GitHub, GitLab, and npm, and 23 AWS keys. Critically, one notified company confirmed its key had been live and exposed. The [vulnerability](/glossary#vulnerability) affects the latest Claude models, Opus 5.5 and Fable 5.1, demonstrating [persistence](/glossary#persistence) across versions. The core issue is aggravated by Claude Code's incomplete integration with Git. While it attempts to add `.claude/settings.local.json` to the user's global Git excludes file, this protection is localized to a single machine and user. Crucially, Claude Code never adds the file to the project's `.gitignore`, meaning the file can easily be committed and pushed to remote repositories. Researchers found that in 539 of 1,105 traced repositories, commits listing Claude as a co-author had modified the file, suggesting the AI assistant itself frequently contributes to its exposure. Furthermore, removing the file from a project does not remediate the leak, as older versions with secrets persist in Git history and across repository forks, amplifying the risk. ### Challenges in Detecting Claude Code Exposed Secrets Traditional secret scanning tools often fall short in identifying these specific types of exposed credentials. Tools like gitleaks and TruffleHog, when run without their verification step, missed a significant portion of the 1,122 files identified by Apiiro. The primary reason for these misses is that many secrets are embedded directly within command-line arguments (e.g., `PGPASSWORD=`, `sshpass -p`), appearing as ordinary words rather than matching known key formats. This highlights the need for specialized detection methods when attempting to **detect Claude Code exposed secrets**. ## Impact and [Risk Assessment](/glossary#risk-assessment) The exposure of such a wide array of credentials poses a severe risk to individuals and organizations. The presence of database vendor admin-level cloud keys and owner passwords for medical-records databases, as highlighted by the researchers, underscores the potential for direct and significant data breaches or system compromise. Over a third of the identified secrets grant direct access to databases. The long-term persistence of these secrets—with many files containing active credentials residing on default branches for over 217 days—further exacerbates the risk. The affected entities include at least 63 organizations, predominantly software companies of varying sizes. This widespread exposure means that development environments, production systems, and sensitive data across multiple sectors are vulnerable to unauthorized access. The difficulty in retrospectively cleaning Git history and the propagation of these secrets through forks mean that the compromised data has a wide and persistent footprint. ## Actionable Recommendations and Mitigations To address this critical exposure and to effectively **mitigate Claude Code password exposure**, immediate and concerted action is required from both developers and security teams. ### For Developers: * **Rotate All Credentials Immediately:** Change every password, token, and key that has ever been present in any `.claude/settings.local.json` file. This is the single most important step. * **Clean Up Git History:** After rotation, use `git filter-repo` or similar tools to remove `.claude/settings.local.json` and any historical commits containing secrets from all repository branches and forks. * **Avoid "Don't Ask Again" for Sensitive Commands:** Exercise extreme caution with the "Yes, and don't ask again" feature, especially for commands that include secrets. Prefer explicit approval or use environment variables for credentials. * **Audit Project Files:** Regularly inspect your project directories and Git history for the `.claude/settings.local.json` file and other potential secret exposures, as copies can also persist in local environments, Docker images, or npm packages. ### For Security Teams: * **Implement Custom Secret Scanning:** Develop and deploy custom rules for secret scanners to specifically identify command-line patterns that embed passwords and tokens, enhancing the ability to **detect Claude Code exposed secrets** beyond standard key formats. * **Developer Education:** Educate developers on secure credential management practices when using AI coding assistants, emphasizing the risks of persistent command logging and the importance of `.gitignore` discipline. * **GitHub Monitoring:** Proactively monitor public GitHub repositories associated with your organization for the presence of `.claude/settings.local.json` files containing secrets. * **Enforce Secure Configurations:** Mandate and verify secure configurations for AI coding assistants that minimize the risk of secret leakage. This incident underscores the need for rigorous security practices in the age of AI-assisted development. While Claude Code users have reported this behavior in bug reports since August 2025, Anthropic has yet to provide a solution, leaving the burden of remediation squarely on developers and security teams. **Related:** [Anthropic's Tiered LLM Access Empowers Cyber Defenders](/blog/anthropic-s-tiered-llm-access-empowers-cyber-defenders), [TeamPCP Hackers Arrested in Australia Over Supply Chain Attacks](/blog/teampcp-hackers-arrested-in-australia-over-supply-chain-attacks) --- AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/claude-code-don-t-ask-again-exposes-secrets-on-github