--- title: Claude Code's "Don't Ask Again" exposes passwords in... description: Apiiro found 2,539 real secrets exposed across 1,994 public GitHub repositories because of how Claude Code saves approved commands. Choosing 'Yes, and don't... canonical: https://daily.dev/posts/claude-code-s-don-t-ask-again-exposes-passwords-in-1-122-public-github-files-5ing6vaqe twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files | daily.dev og:description: Apiiro found 2,539 real secrets exposed across 1,994 public GitHub repositories because of how Claude Code saves approved commands. Choosing 'Yes, and don't... og:url: https://daily.dev/posts/claude-code-s-don-t-ask-again-exposes-passwords-in-1-122-public-github-files-5ing6vaqe og:image: https://api.daily.dev/og/posts/5inG6vAqE.png og:image:alt: Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files **[Hacker News](https://daily.dev/sources/hn)** · 11 min read · 0 upvotes · 0 comments ## Summary Apiiro found 2,539 real secrets exposed across 1,994 public GitHub repositories because of how Claude Code saves approved commands. Choosing 'Yes, and don't ask again' writes the full command, including any secret, into .claude/settings.local.json, which often gets committed. Of 104,185 public copies of that file, 1,122 contain a real secret: database passwords, cloud keys, API tokens and SSH root logins. 63 organizations are affected, including a database vendor's own admin key, a production Azure Postgres password and a Square production token. Scanners miss many of these because passwords are typed inside shell commands rather than in recognizable key formats; gitleaks and TruffleHog together missed 215 of the 1,122 files. Claude commits the file itself in 539 of 1,105 traced repos. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### why is Claude Code leaking secrets to .claude/settings.local.json on GitHub When a developer tells Claude Code 'Yes, and don't ask again' to a proposed shell command, it saves that exact command string, including any secret it contains, to .claude/settings.local.json in the project folder. Nothing marks that file private by default in the repo's own .gitignore, so it often gets committed. Apiiro found 1,122 of 104,185 public copies of this file on GitHub held a real secret. _Developers auditing AI agent configs for leaked credentials can track findings like these on daily.dev._ ### do gitleaks and trufflehog detect secrets typed inside shell commands like PGPASSWORD or sshpass -p Not reliably. Running both scanners over 104,185 files with 1,122 confirmed real secrets, gitleaks flagged 564 and TruffleHog 643, while 215 were caught by neither, because scanners look for recognizable key formats and a password typed after PGPASSWORD=, sshpass -p or mysql -p looks like an ordinary word in a command line. _Teams choosing secret-scanning tools can compare detection gaps like this one on daily.dev._ ### how do I stop Claude Code from saving secrets into its settings file Untrack .claude/settings.local.json with git rm --cached and add it to the repo's own .gitignore, then rotate every credential it ever held since deleting the file doesn't clear git history, forks, or clones. Reference secrets as environment variables like $DB_URL instead of typing them directly, and approve command patterns such as Bash(npm run:*) rather than literal commands with embedded values. _Developers hardening their AI coding agent workflows can find mitigation steps like these on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 122 comments across hackernews (as of 2026-11-09). **TL;DR:** Commenters largely place the blame on developers who commit .claude/settings.local.json (which is gitignored by default) rather than on Claude Code itself, but many are unimpressed by Anthropic's response and push back hard on the claim that 'auto mode' is a safe replacement for manual approval, citing real failures like deleted backups and ignored permission hooks. **Sentiment:** 5% positive · 30% mixed · 65% skeptical **The case for** - Several note the settings file is gitignored by default, so leaks require users to override that or manually commit the file. - Some appreciate an Anthropic engineer showing up quickly to acknowledge the issue and discuss fixes. - A few describe practical mitigations (secret managers, CLI-based credential fetching, hooks) that work well for them. **The pushback** - Many argue it's bad-faith deflection to blame users when the harness itself sometimes commits the file via its own co-authored commits. - Multiple commenters dispute that 'auto mode' is meaningfully safer, saying it offers no real security guarantees and can't be reasoned about like sandboxing. - Reports of auto mode both failing to catch risky actions (e.g., deleting backups) and being overly restrictive/inconsistent, causing approval fatigue from huge unreadable bash chains. - Some see it as a broader pattern of large AI vendors avoiding responsibility while asking the community for free ideas to fix problems they created. **By community** - hackernews (heated): A long, contentious back-and-forth between an Anthropic engineer defending the design/auto-mode and commenters who are skeptical of user-blaming framing and auto-mode's safety claims, mixed with tangential debates about AI-written text and GitHub usage. **Hottest debate:** Whether 'auto mode' is actually safer than manual permission approval or just an unverifiable, non-deterministic substitute with no real security guarantees. **Open questions** - How should an agent handle actions that inherently require a secret without ever writing that secret to a project file? - Can auto mode's classifier be made to reliably catch long, unreadable bash chains instead of either blocking or waving them through inconsistently? - Why does Claude Code add the settings file only to the global gitignore rather than the repo's own .gitignore? **Highlights** > Boris from the Claude Code team here. Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this. That said, a few thoughts: 1. .claude/settings.local.json is meant to stay local. This is not a file you should check into source control. We automatically gitignore it when Claude creates the file, so in this case the files were manually created and checked in (docs: https://code.claude.com/docs/en/settings) 2. Permission rules are old hat. Everyone should be using auto mode instead. It is safer and also does not require manually maintaining finicky allow/deny lists. Auto mode is enabled by default and is included for free in all plans. 3. Regardless of what agent you use, you should have secret scanning enabled. GitHub and other source control hosts offer it. There are many threat models that it protects against and you should absolutely use it if you can. (see https://github.com/security/plans) > — [bcherny on hackernews · 14 comments](https://news.ycombinator.com/item?id=50408126) > Will look into exposing that in hooks. Ultimately, the threat model here is: human has to approve a lot of commands, so gets tired and accidentally approves a command they shouldn’t have. We spent a significant amount of effort to build a richer permission system, allow configuration at multiple levels, use static analysis to detect dangerous and safe commands, monitor the model to detect and block prompt injection at the inference layer, etc. Some of these components we rewrote and red teamed dozens of times. Our conclusion was that despite all of this work, in practice the threat model is that human attention is limited and that that a different approach performs an order of magnitude better in practice. > — [bcherny on hackernews · 3 comments](https://news.ycombinator.com/item?id=50408580) > A key problem when using manual approval with Claude is that too much of Claude's tool use is Bash or Python slop that is difficult to review (especially when you are getting spammed by it) and impossible to handle through rules. Example: sed -n 1,30p src/vm/wren_vm.c && sed -n 310,350p src/vm/wren_vm.c && sed -n 560,600p src/vm/wren_vm.c && sed -n 740,775p src/vm/wren_vm.c && sed -n 40,70p src/vm/wren_common.h && cat util/wren_to_c_string.py | head -80 && ls test/random doc/site doc/site/modules doc/site/modules/random 2>/dev/null; cat projects/premake/premake5.lua | head -80; cat util/generate_projects.py After ten or more of these, you're going to get hit by review fatigue, and then, yes, manual review becomes too error-prone to use safely. The irony is that Claude is regularly ignoring its existing Read/Write/Edit tools that could make everything more readable. Other models/harnesses have their own problems, but Claude Code is one of the worst for manual approval. You can get manual approval to work reasonably well if you give the model a reasonable set of tools (I have literally written my own MCP servers to cover gaps in existing harnesses) where you can then write rules for the vast majority of safe cases. For example, I have a stdio MCP server that allows models to inspect crates under ~/.cargo/registry/src (paired with the existing query-crates MCP server). It provides read-only operations limited to crate data, so I can pretty safely auto-approve everything in there. With the right setup, including a sandbox, you only ever have to manually approve something once in a while and usually with delimited scope, avoiding review fatigue. > — [rbehrends on hackernews](https://news.ycombinator.com/item?id=50409372) > The problem is that you didn't even attempt to build a proper box (a sandbox that prevents the AI from running bad stuff by design). It's an extraordinarily hard problem. Only OpenAI Codex is actually trying to do it, and they suck at it too. They keep breaking permissions, their own AI can't troubleshoot it, their defaults give read to the whole filesystem (go ahead, slurp my ssh keys), and their "manual approval" escape does not seem to work. > — [aftbit on hackernews · 2 comments](https://news.ycombinator.com/item?id=50408976) > It doesn’t matter if they should stay local, day 1 security best practices say you don’t write secrets to files, ever - especially without you even knowing! This is such a typical blame the user response. You realize if I’m a sysadmin managing fleets of machines, this is an actual wake up in a cold sweat nightmare, even if those files never leave disk? In the past it was less a big deal, way bigger now that your machine god will just download packages and libs that have upstream malware that aggressively scans the file system for stuff like this. guess where it’s going to look first? have more humility. jesus. > — [JohnMakin on hackernews](https://news.ycombinator.com/item?id=50409326) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50407882) · 149 points · 122 comments ## Similar posts on daily.dev - [Claude Code ignores ignore rules meant to block secrets](https://daily.dev/posts/claude-code-ignores-ignore-rules-meant-to-block-secrets-n6dlvasmz) · The Register · 1 upvotes · 0 comments - [AI Coding Agents Are Leaking Credentials on Endpoints](https://daily.dev/posts/ai-coding-agents-are-leaking-credentials-on-endpoints-3xkdxyadx) · GitGuardian · 0 upvotes · 0 comments - [News alert: GitGuardian study shows AI coding tools double leak rates as 29M credentials hit GitHub](https://daily.dev/posts/news-alert-gitguardian-study-shows-ai-coding-tools-double-leak-rates-as-29m-credentials-hit-github-hkqb5n1dy) · Security Boulevard · 2 upvotes · 0 comments - [Claude Code is still vulnerable to an attack Anthropic has already fixed](https://daily.dev/posts/claude-code-is-still-vulnerable-to-an-attack-anthropic-has-already-fixed-z6t1eqrrv) · InfoWorld · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#github](https://daily.dev/tags/github), [#claude-code](https://daily.dev/tags/claude-code), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/claude-code-s-don-t-ask-again-exposes-passwords-in-1-122-public-github-files-5ing6vaqe) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Claude Code's \"Don't Ask Again\" exposes passwords in 1,122 public GitHub files","url":"https://daily.dev/posts/claude-code-s-don-t-ask-again-exposes-passwords-in-1-122-public-github-files-5ing6vaqe","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/claude-code-s-don-t-ask-again-exposes-passwords-in-1-122-public-github-files-5ing6vaqe"},"datePublished":"2026-11-07T23:03:01.300Z","dateModified":"2026-11-09T11:04:58.976Z","description":"Apiiro found 2,539 real secrets exposed across 1,994 public GitHub repositories because of how Claude Code saves approved commands. Choosing 'Yes, and don't...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/49476264f6b10970a117321f87ef3460?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/49476264f6b10970a117321f87ef3460?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/claude-code-s-don-t-ask-again-exposes-passwords-in-1-122-public-github-files-5ing6vaqe","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,github,claude-code,secrets-management","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Claude Code's \"Don't Ask Again\" exposes passwords in 1,122 public GitHub files"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/claude-code-s-don-t-ask-again-exposes-passwords-in-1-122-public-github-files-5ing6vaqe#faq","mainEntity":[{"@type":"Question","name":"why is Claude Code leaking secrets to .claude/settings.local.json on GitHub","acceptedAnswer":{"@type":"Answer","text":"When a developer tells Claude Code 'Yes, and don't ask again' to a proposed shell command, it saves that exact command string, including any secret it contains, to .claude/settings.local.json in the project folder. Nothing marks that file private by default in the repo's own .gitignore, so it often gets committed. Apiiro found 1,122 of 104,185 public copies of this file on GitHub held a real secret. Developers auditing AI agent configs for leaked credentials can track findings like these on daily.dev."}},{"@type":"Question","name":"do gitleaks and trufflehog detect secrets typed inside shell commands like PGPASSWORD or sshpass -p","acceptedAnswer":{"@type":"Answer","text":"Not reliably. Running both scanners over 104,185 files with 1,122 confirmed real secrets, gitleaks flagged 564 and TruffleHog 643, while 215 were caught by neither, because scanners look for recognizable key formats and a password typed after PGPASSWORD=, sshpass -p or mysql -p looks like an ordinary word in a command line. Teams choosing secret-scanning tools can compare detection gaps like this one on daily.dev."}},{"@type":"Question","name":"how do I stop Claude Code from saving secrets into its settings file","acceptedAnswer":{"@type":"Answer","text":"Untrack .claude/settings.local.json with git rm --cached and add it to the repo's own .gitignore, then rotate every credential it ever held since deleting the file doesn't clear git history, forks, or clones. Reference secrets as environment variables like $DB_URL instead of typing them directly, and approve command patterns such as Bash(npm run:*) rather than literal commands with embedded values. Developers hardening their AI coding agent workflows can find mitigation steps like these on daily.dev."}}]} ```