THREAT HORIZON
One story this week, because it may be sitting in your own repos right now.
“Don’t Ask Again” Is Quietly Leaking Passwords to GitHub
A Claude Code convenience setting can save approved commands word for word, secrets included. Researchers found more than a thousand of those files sitting in public repositories.
Security firm Apiiro scanned public GitHub and turned up more than 104,000 copies of .claude/settings.local.json, the file where Anthropic’s Claude Code records commands a developer has approved to run without asking again. About 1.1% of those copies contain at least one live-looking secret: 1,379 distinct passwords, tokens and keys in all. Researchers didn’t test whether the credentials still work, but one company they contacted confirmed its key had been active.
The exposure is bigger than the current files. Older versions in git history hold another 734 secrets that no longer appear in any current copy, and 211 forks carry the same secrets as the repos they copied. Count the team-shared settings.json files and saved agent chat logs too, and the tally reaches 2,539 secrets.
How a Password Ends Up on GitHub
You approve a command
Claude Code asks before running a shell command. You click “Yes, and don’t ask again.”
It saves the exact text
When the rule covers one exact command, any password or token typed into it is stored in plain text.
Git ignores it, but only locally
The tool adds the file to your personal global git excludes, not the project’s own .gitignore. That protection never travels with the repo.
It gets committed
In 539 of 1,105 traced repos, a commit co-authored by Claude changed the file, suggesting the assistant often commits it itself.
Risky Rule vs. Safe Rule
"allow": [ "Bash(PGPASSWORD=hunter2 psql -h db.example.com -U admin)" ]
"allow": [
"Bash(psql $DB_URL:*)",
"Bash(npm run:*)"
]Illustrative example. Pull secrets from a secrets manager or environment variable, and approve patterns rather than one-off commands.
What Leaked
Your secret scanner probably won’t catch all of it
Run without verification, gitleaks flagged 564 of the 1,122 leaky files and TruffleHog flagged 643. Neither caught 215. Most of the misses were plain passwords typed into commands, such as after PGPASSWORD=, sshpass -p or mysql -p. To a scanner that hunts for known key formats, those look like ordinary words.
Apiiro compared documentation for 16 coding agents and found Claude Code was the only one confirmed to save the full approved command into a project file by default. Users have reported the behavior before, starting with a bug report filed in August 2025. The researchers say all four related reports were closed automatically for inactivity, with no response from Anthropic.
🌅 SunsetHost Fix-It Checklist
0 of 6 done
- Search every repo and its history. Look for
.claude/settings.local.jsonand.claude/settings.json, including deleted versions:git log --all -- .claude/ - Rotate first. Change every password, token and key those files ever held before you clean up. Deleting the file doesn’t remove it from history or forks.
- Stop tracking the local file.
git rm --cached .claude/settings.local.json, then add it to the project’s own.gitignore. - Clean your local copy. Open the file on your own machine, even if it was never committed, and delete any rule containing a secret.
- Keep secrets out of commands. Reference them as variables like
$DB_URLand approve patterns likeBash(npm run:*). - Treat agent folders like .env files. Add
.claude/,.cursor/,.gemini/and.specstory/to pre-commit and CI secret scanning. Check npm packages, Docker images, zips and synced folders too.
The Bottom Line
AI coding agents remember things so you don’t have to click “approve” twice, and that memory is now part of your attack surface. If a credential has ever passed through an agent’s approval prompt, assume it’s written down somewhere. Find it, rotate it, then make sure it can’t be written down again.