Claude Code's 'Yes, and Don't Ask Again' Feature Leaks Sensitive Secrets to GitHub

Researchers from Apiiro have uncovered a significant security vulnerability in Anthropic's Claude Code, where the AI assistant's "Yes, and don't ask again" feature can lead to the exposure of sensitive credentials like passwords and API keys. The issue stems from how Claude saves approved commands in its local settings file, .claude/settings.local.json. When a developer approves a command that includes a secret, such as a database connection string or an API key, and selects the "Yes, and don't ask again" option, this command is stored and can be automatically re-executed without further prompting.

The primary risk arises when this .claude/settings.local.json file, containing these sensitive commands, is committed and pushed to a public GitHub repository. Apiiro's investigation identified over 2,500 distinct secrets across nearly 2,000 public repositories, impacting 63 organizations. These exposed secrets included critical data such as database administrator credentials, production Azure PostgreSQL passwords, and sensitive tokens for services like Square, highlighting the broad potential impact across various industries.

While Claude Code does implement some protective measures, such as adding an exclusion to a developer's global Git ignore file when it first writes the file within a Git repository, these safeguards are not foolproof. This protection does not extend to files already tracked by Git, nor does it reliably cover folders that are later converted into repositories. Consequently, secrets embedded in these local settings files can easily bypass intended security controls.

Apiiro's analysis of 104,185 public copies of .claude/settings.local.json revealed that 1,122 files contained secrets, with 1,379 distinct credentials identified. The total count of 2,539 secrets was derived by examining earlier commits, shared settings, and agent transcripts. The exposed credentials spanned a wide range, including database access information, cloud credentials, private keys, package registry tokens, and SSH logins, some of which contained root passwords.

This vulnerability differs from previous Claude Code configuration issues where attackers actively manipulated settings. Instead, this exposure occurs during normal, legitimate development workflows. The ease with which these secrets are exposed means that malicious actors could potentially leverage them for unauthorized access or data breaches without needing to compromise accounts or use sophisticated attack vectors.

Standard security scanning tools like Gitleaks and TruffleHog did not catch all instances of exposed secrets, particularly those embedded in less conventional formats, such as after PGPPASSWORD= or within request headers. This underscores the need for more comprehensive auditing of AI-generated code and configuration files.

To mitigate this risk, developers are advised to immediately rotate any exposed credentials. They should then search their current files and Git history for .claude/settings.local.json and any shared .claude/settings.json files, carefully reviewing allow rules for any sensitive information. It is crucial to untrack local settings using git rm --cached .claude/settings.local.json and add the path to the repository's .gitignore. Furthermore, using secret management systems instead of embedding literal passwords in commands is strongly recommended.

Security teams should also extend their scanning efforts to include AI agent folders and conversation histories, specifically looking for command-embedded passwords and API keys. The findings highlight a growing trend where AI development tools, while boosting productivity, introduce new attack surfaces that require diligent security practices and continuous monitoring.