---
title: "[AUTO] Claude Code's 'Don't Ask Again' Exposes 2,539 Secrets"
pubDatetime: 2026-11-07T19:21:00.000Z
description: "Apiiro found 2,539 secrets exposed in Claude Code's settings file across GitHub repositories."
tags: [claude-code, ai-security, credentials, vulnerability, 2026, 2026-q4, 2026-11, AUTO]
---
Claude Code's "don't ask again" setting exposed 2,539 secrets across nearly 2,000 GitHub repositories, per [Apiiro's research](https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again). When developers opt to skip future prompts after approving a command, Claude Code stores the full command with embedded credentials in `.claude/settings.local.json`. Exposed secrets included 379 database passwords, SSH keys, cloud service credentials, and registry tokens. One organization confirmed an exposed key remained active.

The trap is sound UX: asking a user 50 times is worse than storing a choice. But storing *secrets* in a repository-root file with only `.gitignore` protection doesn't hold. Forks, git history queries, and commits with other changes all bypass it. Whether Anthropic has since patched this is unclear.

Developers using real credentials in test workflows have no safe options. The lesson: frame this as a storage risk, not a general "don't use credentials" warning. Give teams something concrete: rotate any secrets typed into Claude Code, assume they're permanently logged, and if tools need credentials, keep them off your machine.

---

*Sources: [Coding Agents Leaking Secrets to GitHub – Don't Ask Again](https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again)*

*Coverage: [Claude Code's 'Don't Ask Again' File Exposes Passwords and Keys in 1,122 Public Copies on GitHub](https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html)*

*Related on this blog: [[AUTO] Any User Can Become Admin in LiteLLM](/posts/auto-litellm-privilege-escalation)  •  [[AUTO] LLMJacking: The Industrialized Theft of AI Keys](/posts/auto-llmjacking-industrialized-ai-keys)  •  [[AUTO] Trigger.dev Credential Access Incident](/posts/auto-trigger-exposure)*