Claude Code’s “Yes, and Don’t Ask Again” Option Can Leak Passwords and API Keys to GitHub

Claude Code’s “Yes, and don’t ask again” option can save passwords and API keys inside project settings that later reach public GitHub repositories.

Apiiro researchers found 2,539 distinct secrets across 1,994 public repositories, showing how a routine approval can turn private credentials into public data.

The research identified 63 affected organizations, mostly software companies. Exposed credentials included a database vendor’s admin-level cloud key, a production Azure PostgreSQL password, a Square production token, and the owner password for a medical-records database. Apiiro said one company confirmed its exposed key had been live.

The leak starts during ordinary development work. A developer asks Claude Code to check a database, test an API, or troubleshoot a failed login. Claude prepares a shell command containing a credential from a configuration file, then asks for permission before running it.

Choosing “Yes, and don’t ask again” can store that command, including its secret, in .claude/settings.local.json. The command becomes an allow rule, letting Claude Code run it again without another prompt. The danger comes when that local file is committed and pushed to GitHub.

Claude Code does try to prevent this. When it first writes the file inside a Git repository, it adds an exclusion to the developer’s global Git ignore file. However, that protection does not travel with the project, cover files already tracked, or reliably protect a folder turned into a repository later.

Local Approvals Become Public Secrets

Apiiro’s research examined 104,185 public copies of .claude/settings.local.json. Researchers found real secrets in 1,122 files, holding 1,379 distinct credentials. Checking earlier commits, shared settings, and agent transcripts brought the total to 2,539. Collection took place November 1–3, 2026.

Anthropic’s settings documentation confirms that standing approvals are saved in the local settings file. Its permissions guide explains that shell approvals can persist across sessions. A GitHub issue reported plaintext credential storage in approved commands as early as August 2025.

The distinction matters. This exposure does not require a malicious prompt or a stolen account. It follows a normal approval flow. Earlier Claude Code configuration vulnerabilities involved attackers changing project settings to steal API keys, but this finding concerns secrets recorded during legitimate work.

Apiiro found that databases accounted for a large share of exposed access, including 379 database passwords and 122 Supabase service-role keys. Other findings included cloud credentials, private keys, package-registry tokens, and 43 SSH logins. Some SSH commands contained root passwords.

Standard scanning did not catch everything. Of the 1,122 affected local settings files, Gitleaks flagged 564 and TruffleHog flagged 643. Neither tool flagged 215 files. Passwords embedded after PGPASSWORD=, sshpass -p, or inside request headers often lack the clear formats used to recognize provider-issued keys.

Keeping these files off GitHub also leaves a local risk. Malware can read plaintext settings on compromised laptops. The Shai-Hulud npm supply-chain attack already demonstrated how attackers use TruffleHog to search developer files for credentials. That history makes agent approval files a practical target, not just a publishing mistake.

Developers should search current files and Git history for .claude/settings.local.json and inspect shared .claude/settings.json files. Review allow rules for passwords, tokens, connection strings, and authorization headers. Apiiro also found secrets in saved agent conversations, memory files, and deployment notes.

The first response is rotation, not deletion. Revoke exposed credentials before removing files or rewriting history. Untrack local settings with git rm --cached .claude/settings.local.json and add the path to the repository’s .gitignore.

Use secret-manager references rather than literal passwords in commands. Security teams should scan agent folders and history, with checks for command-embedded passwords as well as recognizable API keys.

The post Claude Code’s “Yes, and Don’t Ask Again” Option Can Leak Passwords and API Keys to GitHub appeared first on Cyber Security News.