Claude Code's 'don't ask again' option exposed passwords in 1,122 public GitHub files
Apiiro counted 2,539 secrets in 1,994 public repositories after Claude Code saved approved commands, with credentials, to a local settings file.
By Ryan Merket · Published
Primary source: Apiiro
Why it matters
A one-time approval in an AI coding agent became a persistent file containing the credential itself, and that file was committed often enough to expose production passwords and keys at scale. The gap is structural: the ignore rule lives on one developer's machine while the file lives in the project, so the protection fails exactly when code moves.
Anthropic's Claude Code saved approved shell commands, credentials included, to a project file that ended up public in 1,122 copies on GitHub, according to research published on November 5th, 2026, by Apiiro researchers Shmulik Cohen and Matan Giladi in the Apiiro report. Security firm Apiiro said 1,122 of the 104,185 public copies of that file it found on GitHub hold a real secret.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.