On 2026-11-05 Apiiro researchers Shmulik Cohen and Matan Giladi reported that when a Claude Code user picks "Yes, and don't ask again" on an exact command, the command is saved verbatim—any password or token included—to the project's .claude/settings.local.json. Of 104,185 public GitHub copies of that file, 1,122 hold at least one secret; counting git history, shared settings.json and saved agent transcripts, the total is 2,539 secrets across 1,994 repos. Apiiro did not test whether the credentials work and advises rotating first, then cleaning up.
Key Takeaways
- ✓Trigger: when "don't ask again" saves an exact command, any password or token in it lands verbatim in .claude/settings.local.json
- ✓Scale (Apiiro figures): 1,122 of 104,185 public copies (~1.1%) hold secrets, 1,379 distinct; 2,539 secrets across 1,994 repos overall
- ✓Mix: over a third open a database directly (379 DB passwords), plus 43 SSH logins, 42 GitHub/GitLab/npm tokens and 23 AWS keys
- ✓Scanner gap: gitleaks flagged 564 and TruffleHog 643; 215 files were missed by both, mostly passwords typed inside commands
- ✓Fix: rotate every secret the file ever held, then git rm --cached and add it to the repo's own .gitignore; prefer pattern rules like npm test *
Key Decision Metrics at a Glance
Heavy Claude Code use: compare subscription limits and API bills
Compare 40 dev plans & simulate token costs vs $20/mo subscriptions
Project Links & Resources
Direct AccessIn-Depth Technical Analysis
Core Background & Industry Pain Points
Coding agents ask before running shell commands, and "don't ask again" removes repeat prompts by saving the approved rule inside the project. Apiiro found that when the prompt offers an exact command rather than a pattern like npm test *, any database password or token typed into it is stored verbatim—so committing and pushing the file publishes the secret.
Architecture Highlights & Internals
Rules live in .claude/settings.local.json. Per the documentation Apiiro cites, the first time Claude Code writes the file in a git repo it adds it to the user's global git excludes, but never to the project's own .gitignore—so the protection does not travel to a clone on another machine or cover a file already committed. The researchers say they reproduced the behavior with Opus 5.5 and Fable 5.1, and deleting the file does not remove copies in git history or forks.
Authoritative Benchmarks & Measured Scores
Data comes from GitHub code search on default branches, Nov 1–3: 104,185 files, 1,122 with secrets, 1,379 distinct secrets. Older versions hold 734 more (509 repos); 211 forks of 74 repos carry the same secrets; 298 of 76,011 shared settings.json files also contain secrets. Total: 2,539 secrets across 1,994 repos. gitleaks flagged 564 and TruffleHog 643 of the 1,122 files; 215 were missed by both. Apiiro did not test the credentials, but notified affected organizations, and one confirmed its key had been live.
Developer Hands-on Guide
1) Search your org for .claude/settings.local.json and .claude/settings.json, including git history. 2) Rotate every password, token and key they ever held. 3) Run git rm --cached .claude/settings.local.json and add it to the repo's .gitignore. 4) Open the local file and delete any rule containing a secret. 5) Approve pattern rules going forward and keep secrets in environment variables or a secrets manager instead of inline commands.
Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.