Report: Apiiro Says Claude Code's "Don't Ask Again" Exposed Passwords in 1,122 Public GitHub Files. Check .claude/settings.local.json

Verdict: if anyone on your team ever clicked "Yes, and don't ask again" on a command that carried a password, token or key, assume that credential sits in .claude/settings.local.json, and check whether the file reached Git. Apiiro's count is reported and we could not read its post, but the mechanism is in Anthropic's own docs: "Yes, and don't ask again" saves the approval as an allow rule in .claude/settings.local.json, and Claude Code keeps that file out of commits only through your global git excludes. Claude Code stays conditional in our directory: this is a configuration hazard you can close today, not a reason to drop the tool.

What happened

Security firm Apiiro published research on the permission file Claude Code writes. It reached Hacker News on 7 November as "Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files". Apiiro's site refused our requests (HTTP 403), so we could not check its method, its other figures or what it counted as a secret. Anthropic's settings docs confirm the mechanism: when you choose "Yes, and don't ask again" for a Bash command, Claude Code saves that approval as an allow rule in .claude/settings.local.json. If the approved command contained a password or token, the secret sits in that rule.

Why the file ends up in Git

The first time Claude Code writes the file, it adds **/.claude/settings.local.json to your global git excludes file, not to the repository's .gitignore. A global excludes file lives on one machine, so the repository itself carries no rule that keeps the file out, and the docs say that if you create the file by hand you must add it to .gitignore yourself. Do not rely on a secret scanner as the backstop: a password inside a command string may not match the key formats scanners look for.

What Anthropic has said

Boris Cherny, who leads Claude Code, replied in the Hacker News thread on 7 November: "Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this." In the same comment he wrote that the file "is meant to stay local", that Claude Code gitignores it automatically when it creates it, "so in this case the files were manually created and checked in". He also told users to switch to auto mode and to turn on secret scanning at their Git host. Neither the 2.1.319 (6 November) nor the 2.1.321 (9 November) changelog entry addresses it. 2.1.321 does fix a different secrets bug (MCP OAuth requests sending refresh tokens to another host on redirect), which is not this issue. Treat the behaviour as current.

What changes for you

FAQ

Is my secret exposed if the file never left my machine? Not through GitHub. The exposure path is the file being committed and pushed, so check Git status and history before anything else.

Will a secret scanner catch it? Not reliably. A password inside an approved command may not match the formats scanners look for, so search the file directly.

Has Anthropic shipped a fix? Not as of the 2.1.321 release on 9 November. Boris Cherny said the team is "looking into what we can do to prevent this".