Osegi
Security·2 min read

Claude Code's "don't ask again" option leaked secrets on GitHub

Claude Code saved approved commands, passwords included, in plain text in a local file. Researchers at Apiiro found that credentials ended up in public GitHub repositories.

A developer's code editor showing an AI coding assistant permission prompt next to a warning about exposed passwords and API keys.
Image: xataka.com
SUMODialoediviewergiftdetect

Choosing "Yes, and don't ask again" in Claude Code can store sensitive credentials in plain text, and some of them have ended up in public GitHub repositories. The issue was uncovered by researchers at Apiiro, who found leaked database passwords, SSH logins, private keys, GitHub tokens and AWS keys.

How the leak happens

To remember a permission, Claude Code writes the literal command to a project file, .claude/settings.local.json. If that command contained a password, the password is saved as-is. The file is meant to stay on the developer's machine, but if it was already committed, or another computer working on the project pushes it, the contents travel to GitHub along with the rest of the code.

Anyone who finds a private API key in a public repository could cause the developer serious financial damage, which is why the exposure matters.

Vibecoding raises the stakes

The behavior is logical: to avoid nagging the user, the tool stores the exact approved command. The risk grows when developers push files without reviewing them. GitHub's Octoverse 2026 report shows how much AI-assisted coding has increased activity: 17.9 billion pushes and 34.3 billion commits in the twelve months to 30 September, with pushes exceeding 2024 and 2025 combined. In September, more than 40% of pull requests originated from an AI agent, up from 17% in March.

Anthropic's response

Anthropic issued no statement, but Boris Cherny, who leads Claude Code, replied on Hacker News. He acknowledged that the tool has never scrubbed secrets from what it saves, and argued the file is designed to stay local. Because Claude Code excludes it from Git when creating it, he says the leaked files were created manually and uploaded later.

Until a definitive fix arrives, Cherny recommends using Claude Code's auto mode and enabling secret scanning on the repository. The team is testing two improvements: auto mode that detects data leakage, and a basic built-in secrets scanner. Neither has a release date.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Tags:claude codeanthropicgithubapiirosecrets leakvibecoding

More from this day

See all →

More in: Security

See all →