Claude Code’s “don’t ask again” setting exposed 2,539 secrets across nearly 2,000 GitHub repositories, per Apiiro’s research. When developers opt to skip future prompts after approving a command, Claude Code stores the full command with embedded credentials in .claude/settings.local.json. Exposed secrets included 379 database passwords, SSH keys, cloud service credentials, and registry tokens. One organization confirmed an exposed key remained active.
The trap is sound UX: asking a user 50 times is worse than storing a choice. But storing secrets in a repository-root file with only .gitignore protection doesn’t hold. Forks, git history queries, and commits with other changes all bypass it. Whether Anthropic has since patched this is unclear.
Developers using real credentials in test workflows have no safe options. The lesson: frame this as a storage risk, not a general “don’t use credentials” warning. Give teams something concrete: rotate any secrets typed into Claude Code, assume they’re permanently logged, and if tools need credentials, keep them off your machine.
Sources: Coding Agents Leaking Secrets to GitHub – Don’t Ask Again
Coverage: Claude Code’s ‘Don’t Ask Again’ File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Related on this blog: [AUTO] Any User Can Become Admin in LiteLLM • [AUTO] LLMJacking: The Industrialized Theft of AI Keys • [AUTO] Trigger.dev Credential Access Incident