---
title: Apiiro: Claude Code's "Yes, and don't ask again" approvals left 1,122 public settings.local.json files holding real secrets on GitHub | ctxsec
url: https://ctxsec.com/items/apiiro-claude-code-dont-ask-again-settings-local-json-secrets-github
description: "Anthropic's Claude Code docs confirm that choosing \"Yes, and don't ask again\" on a Bash permission prompt saves that approval as an allow rule in the project's .claude/settings.local.json, and that Claude Code keeps the file out of commits by adding it to the user's global git excludes, not the repo's own .gitignore. Apiiro researchers say that if the approved command contained a password or key, it is saved verbatim, and that they found 104,185 public copies of the file on GitHub, 1,122 of which hold a real secret (1,379 distinct values). Counting git history, the shared .claude/settings.json and committed agent transcripts, Apiiro puts the total at 2,539 distinct secrets in 1,994 repos, and says about one in five secret-bearing files was missed by both gitleaks and TruffleHog. Apiiro did not try the credentials, so this is an exposure finding, not a confirmed breach."
status: "vendor research (Apiiro, Nov 5, as reported by The Hacker News and iTWire Nov 7; Apiiro's page is script-rendered and we could not read it directly); file behavior confirmed in Anthropic's Claude Code settings docs; Apiiro did not test the credentials"
published: 2026-11-07
---

> Anthropic's Claude Code docs confirm that choosing "Yes, and don't ask again" on a Bash permission prompt saves that approval as an allow rule in the project's .claude/settings.local.json, and that Claude Code keeps the file out of commits by adding it to the user's global git excludes, not the repo's own .gitignore. Apiiro researchers say that if the approved command contained a password or key, it is saved verbatim, and that they found 104,185 public copies of the file on GitHub, 1,122 of which hold a real secret (1,379 distinct values). Counting git history, the shared .claude/settings.json and committed agent transcripts, Apiiro puts the total at 2,539 distinct secrets in 1,994 repos, and says about one in five secret-bearing files was missed by both gitleaks and TruffleHog. Apiiro did not try the credentials, so this is an exposure finding, not a confirmed breach.

[← Context & Harness Attacks](/context) · [markdown](/items/apiiro-claude-code-dont-ask-again-settings-local-json-secrets-github.md)

vendor research (Apiiro, Nov 5, as reported by The Hacker News and iTWire Nov 7; Apiiro's page is script-rendered and we could not read it directly); file behavior confirmed in Anthropic's Claude Code settings docs; Apiiro did not test the credentials

2026-11-07

### Apiiro: Claude Code's "Yes, and don't ask again" approvals left 1,122 public settings.local.json files holding real secrets on GitHub

- **Why it leaks:** global excludes do not travel with a fresh clone, a folder that becomes a repo later, another machine, or a file already committed.
- **Why scanners miss it:** passwords typed inline in commands (e.g. `psql postgres://user:pass@host`, `sshpass -p`) do not match the key formats scanners look for.
- **Do now:** see the paired tip — search your repos and their history for `.claude/settings.local.json`, rotate anything it ever held, then untrack and ignore it.
- Apiiro says Claude Code was the only one of 16 coding agents it compared that writes the full approved command to a project file by default (vendor claim).

Sources: [Apiiro: coding agents leaking secrets via "don't ask again" (Nov 5)](https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again) · [Claude Code docs: settings files (settings.local.json and standing approvals)](https://code.claude.com/docs/en/settings) · [The Hacker News: Claude Code's "Don't Ask Again" file exposes passwords and keys (Nov 7)](https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html) · [iTWire: Claude Code approval files found exposing company secrets](https://itwire.com/business-it-news/security/claude-code-approval-files-found-exposing-company-secrets-on-github-says-apirro-researchers)