Claude Code's "don't ask again" option leaked 2,539 developer secrets to public GitHub repos, Apiiro finds

A convenience option in Anthropic's Claude Code has exposed thousands of developer secrets on public GitHub, security firm Apiiro reports. Claude Code asks before running most shell commands. When a user picks "Yes, and don't ask again", the exact command is saved as an allow rule in .claude/settings.local.json inside the project folder, including any password or token typed into it, and that file is often committed with the rest of the code.

Apiiro found 2,539 real secrets in 1,994 public repositories, including database passwords, cloud keys, API tokens and SSH root logins. Most belong to individual developers, but 63 organisations are affected, among them a database vendor's own admin-level cloud key and the owner password of a medical-records database. One organisation confirmed its key had been live. Apiiro says the behaviour is a property of Claude Code, not of the underlying model.

Boris Cherny, head of Claude Code at Anthropic, said on Hacker News that "historically Claude Code has not done secret scrubbing" and that the team is "looking into what we can do to prevent this", including making auto mode catch such commands and building in basic secret scanning, iTnews reports. Apiiro advises developers to search for the settings files, check git history and rotate any exposed secrets first.