Apiiro, a security research firm, checked 104,185 public copies of one Claude Code file1. It found real passwords and keys inside 1,122 of them. Some had sat there for the better part of a year.
The file comes from a single click. Claude Code asks permission before it runs a command, and a developer can answer "Yes, and don't ask again"1. The approval saves that instruction, word for word, to a project file. A password typed into it rides along in plain text.
A Convenience Click Writes a File
The shortcut exists for a real reason. Claude Code can ask a developer to approve dozens of commands in a single session, and each prompt breaks their focus2. "Yes, and don't ask again" trades that interruption for speed.
Claude Code calls the file .claude/settings.local.json, and Anthropic's own documentation describes one safeguard for it2. The tool adds the file to a developer's global git-ignore list, the first time it writes the file.
That git-ignore list sits on one machine alone. A teammate's clone starts clean, and a build server does too, apart from someone writing the same line into the project's own .gitignore2.
Apiiro counted 1,379 credentials sitting inside the 1,122 exposed files1. Database passwords led the list at 379, and 122 more were Supabase service-role keys. Forty-three SSH logins reached live servers, 42 tokens opened GitHub, GitLab or npm accounts, and 23 keys unlocked Amazon's cloud.
Four Warnings, Closed by the Same Bot
A developer flagged this exact risk more than a year before Apiiro's scan. The bug report went in on Aug. 11, 2025, describing approved commands that stored passwords and tokens word for word1.
Anthropic's own bot closed that report on Jan. 3, 2026, marked "not planned"1. The company itself stayed quiet.
Three more reports said the same thing in the months after. Each one met the same bot, the same label, and silence from Anthropic1. Four warnings got the same quiet answer.
453 Days Separate the First Warning From the Public Scan
Dated milestones from the first bug report to the public research that followed it, as reported Nov. 7, 2026
Each pin marks one dated event; the gap between the first two pins is the span a bot's closing label covered before the public research arrived.
Source: The Hacker News [1]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Date | Event |
|---|---|
| Aug. 11, 2025 | Bug report filed. A developer reports passwords stored in plain text |
| Jan. 3, 2026 | Report closed by bot. A bot closes the report, declining further action |
| Nov. 7, 2026 | Research reported. Apiiro's public scan reaches the press |
Two Engineers Disagree on Hacker News
The finding reached Hacker News the same day the press reported it1. Boris Cherny, who built Claude Code at Anthropic, answered inside the thread himself.
He said the tool already protects the file. ".claude/settings.local.json is meant to stay local. This is not a file you should check into source control. We automatically gitignore it when Claude creates the file, so in this case the files were manually created and checked in," Cherny wrote3.
Cherny then listed three fixes Anthropic plans to test. They include a stricter autonomous mode, built-in secret scanning, and a reminder to turn on the scanning GitHub already offers every account3. All three, in his telling, sit above the single click that started this story.
Matthew Honnibal, who built the open-source language tool spaCy, pushed back in the same thread. He wants the system itself to hold the line, ahead of any single developer's habit.
"I want to draw deterministic boundaries around what the agent can do. I don't want a probabilistic approach to security," Honnibal wrote4.
Database Passwords Make Up More Than a Quarter of 1,379 Leaked Credentials
Credential type among 1,379 secrets Apiiro found in 1,122 public Claude Code settings files, as reported Nov. 7, 2026
Each bar is one credential type Apiiro counted; longer bars mean more of that type turned up in the 1,122 exposed files.
These five types total 609 of the 1,379 credentials Apiiro counted; the remaining credentials span other key and token types this chart skips.
Source: The Hacker News [1]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Database passwords | 379 |
| Supabase service-role keys | 122 |
| SSH logins to live servers | 43 |
| GitHub, GitLab or npm tokens | 42 |
| AWS keys | 23 |
Read against each other, the two engineers answer different questions. Cherny describes what the software does when a developer leaves it alone. Honnibal describes what still goes wrong once a person steps in.
The Shape of 1,379 Secrets
Two scanners built to catch exactly this kind of leak still missed a fifth of the files. Gitleaks caught 564 of the 1,122. TruffleHog caught 6435.
Together they missed 215. Many of those secrets sat written as PGPASSWORD= or inside a request header, a shape both scanners missed5.
The leak reached past the newest file, too. Older versions of the settings file carried 734 more secrets across 509 repositories6. Another 211 forks of 74 repositories inherited the same exposed credentials. The trail ran to 63 organizations, mostly software companies that build on Claude Code themselves1.
Apiiro left one question open across most of the find. Researchers skipped testing whether any exposed key still works today1. One exception stands out: a company Apiiro contacted directly confirmed its own key was still live. A habit of rotating credentials on a fixed schedule would have kept that key safe before Apiiro ever reached out.
What to Do
Search every repository you run Claude Code in for .claude/settings.local.json, and check its full history, past the latest commit alone1. Treat anything you find the way you would treat a password mailed to a stranger. Rotate it, then remove the file.
Write the file into your project's own .gitignore by hand2. Anthropic's automatic protection lives on your machine alone. A teammate's laptop, a fresh clone and a build server all need that same line written into the repository itself.
Turn on GitHub's secret scanning for every repository you own, public or private3. Cherny says every developer should run it, regardless of which coding agent they use.
By the Numbers
- 1,122 files: held a real secret inside Claude Code's settings file, among 104,185 copies Apiiro checked1.
- 1,379 credentials: sat inside those 1,122 files, including 379 database passwords and 23 AWS keys1.
- 2,539 secrets: Apiiro's wider count, reaching old commits, forks and shared settings across 1,994 repositories1.
- 63 organizations: had a leaked secret trace back to them, mostly software companies1.
- 215 files: carried a secret that beat both Gitleaks and TruffleHog, the scanners built to catch this5.
- 453 days: from the first bug report, filed Aug. 11, 2025, to the public research that followed, reported Nov. 7, 20261.
What to Watch
Watch whether Anthropic ships the secret scanning Cherny described on Hacker News, and whether it reaches every plan as the default. GitHub's own scanning catch rate on this exact file type matters just as much. A check built into the host, standing ahead of any developer's own choice, would close the gap the 215 missed files opened5. Next year's follow-up scan, run by Apiiro or a rival firm, would settle whether the fix actually worked.
Sources
- The Hacker News, "Claude Code's "Don't Ask Again" File Exposes Passwords and Keys on GitHub," Nov. 7, 2026, https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html
- Anthropic, "Settings files and precedence," Claude Code Docs, accessed Nov. 8, 2026, https://code.claude.com/docs/en/settings
- Boris Cherny, Hacker News comment, Nov. 7, 2026, https://news.ycombinator.com/item?id=50407882
- Matthew Honnibal, Hacker News comment, Nov. 7, 2026, https://news.ycombinator.com/item?id=50407882
- Cybersecurity News, "Claude Code's "Yes, and Don't Ask Again" Option Can Leak Passwords and API Keys to GitHub," Nov. 7, 2026, https://cybersecuritynews.com/claude-codes-yes-and-dont-ask-again/
- GBHackers, "Claude Code's "Don't Ask Again" Feature Exposes 2,539 Secrets Across 1,994 GitHub Repositories," GBHackers, Nov. 7, 2026, https://gbhackers.com/claude-codes-dont-ask-again-feature-exposed/
