Claude Code Secrets on GitHub: Is Your "Don't Ask Again" File Holding Your Passwords?
Cover stat: about 1,100 public copies of the file held secrets, from 63 organizations. Source: Apiiro research, reported by Ars Technica (Nov. 9, 2026), via Apple News: https://apple.news/ABrQKZA_uSCaay9e8LX9PHA and https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/. Illustrative file; the masked value is not a real secret.
It might be. When you click "Yes, and don't ask again" in Claude Code, the tool can save the exact command you approved in a small project file, including any password or token you typed into it, and that file sometimes ends up on public GitHub.
The good news: you can find it, fix it and prevent it.
You can watch the short version here: Watch the Short on YouTube
The video uses a digital avatar of Erick Grau, CEO of Chibitek.
Why This Matters
Security researchers at Apiiro found over 100,000 public copies of Claude Code's local settings file on GitHub, and about 1,100 of them, from 63 organizations, held secrets such as database passwords, API tokens and private keys (Apple News, Ars Technica). Apiiro's own count is more precise: 104,185 copies in 103,617 repositories, with 1,122 copies holding 1,379 distinct secrets (Apiiro research, as reported by The Hacker News).
Think of it like a sticky note with your alarm code. On your fridge, small risk. Taped to the front door, open invitation.
How Does a Password End Up in That File?
If you pick "Yes, and don't ask again," Claude Code writes an approval rule into .claude/settings.local.json in your project. Sometimes that rule is a pattern. Sometimes it is the exact command, secret included.
Anthropic's settings documentation says Claude Code adds this file to your global git excludes the first time it writes it. That protection lives on your computer only. It is not added to the project's own .gitignore, so if the repo moves to another machine, a folder becomes a repo later, or the file gets committed, it can reach GitHub.
Deleting it later does not undo the leak, because copies stay in git history and forks (Ars Technica).
What Should You Do Right Now?
Search everywhere. Look across your GitHub organization for .claude/settings.local.json and .claude/settings.json, including git history where the files are gone.
Rotate first, clean second. Change every password, token and key the file ever held before you delete anything.
Stop tracking the local file. Run git rm --cached .claude/settings.local.json and add it to the project's own .gitignore.
Check your own computer. Delete any rule in the local file that contains a secret, even if it was never committed.
Keep secrets out of commands. Use a variable from a secrets manager (for example $DB_URL) so the rule stores a name, not the value.
Approve patterns, not one-off commands. A rule like Bash(npm run:*) beats one exact command with a password inside.
These steps follow the researchers' guidance, as summarized by The Hacker News.
One caution: Apiiro found that 215 of the roughly 1,100 public secrets were not flagged by two popular scanners, gitleaks and TruffleHog (Apple News, Ars Technica). A clean scan is not the same as a clean file.
1,379 distinct secrets in public settings.local.json files, by kind; 379 were database passwords, and 501 open a database directly. Apiiro did not test whether they still work. Source: Apiiro research (Shmulik Cohen and Matan Giladi), chart published in the Ars Technica story (Nov. 9, 2026), via Apple News: https://apple.news/ABrQKZA_uSCaay9e8LX9PHA and https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/. Chart rebuilt by Chibitek from Apiiro's published numbers.
What Is Anthropic Saying?
Boris Cherny of Claude Code said the team is looking into what it can do, and that these files should pretty much never be checked into git. He recommended auto mode and secret scanners, and called it a good catch when a user noted that auto mode can still save sensitive commands (Apple News, Ars Technica).
Key Points of Claude Code Secrets on GitHub
"Yes, and don't ask again" can save the exact command, secret included, in .claude/settings.local.json.
The built-in protection lives on one computer, not in the project.
Apiiro found about 1,100 public copies with secrets, from 63 organizations (Ars Technica via Apple News).
Deleting the file does not remove it from history or forks.
Rotate every credential first, then clean up.
Keep secrets in variables and approve patterns, not one-off commands.
Frequently Asked Questions
I deleted the file. Am I done?
No. Older versions live in git history and forks. Rotate every credential it ever held.
Will a secret scanner catch it?
Not always. Apiiro found 215 secrets that neither gitleaks nor TruffleHog flagged (Ars Technica), and most misses were passwords typed inside commands (The Hacker News).
Were the leaked keys actually working?
Apiiro did not test them. The Hacker News reports that one company the researchers notified confirmed its key had been live (The Hacker News).
What about .claude/settings.json?
Teams commit that file on purpose, so check it too. Apiiro found secrets in 298 of 76,011 public copies (Apiiro research, as reported by The Hacker News).
Let's Keep Your Keys Where They Belong
At Chibitek, we help businesses use AI coding tools with clear rules, secure secrets and no geek-speak. Don't let a convenient click become a public password. Contact us at hello@chibitek.com to learn how we can help you find exposed credentials, rotate them and set guardrails your team will actually use.
Further reading: the story Erick shared on Apple News and the full article at Ars Technica.
You can watch the short version here: Watch the Short on YouTube
We make IT effortless so you can create, disrupt, and grow!
Comments