Claude Code Security Risk: How the “Don’t Ask Again” Setting Exposed 2,539 Secrets

Claude Code is facing security concerns after researchers discovered thousands of exposed credentials linked to its local settings files.

Security firm Apiiro found 2,539 secrets across 1,994 GitHub repositories, including database passwords, API keys, and SSH logins.

The issue involves a permission feature designed to make coding easier, raising questions about how AI coding agents handle sensitive information and whether developers can safely rely on their default settings.

Key Takeaways

• Apiiro identified 2,539 exposed secrets across 1,994 GitHub repositories.

• Claude Code’s “Don’t Ask Again” feature could save credentials in plain text within local settings files.

• Anthropic is exploring additional protections, while developers are advised to rotate exposed credentials and review repository settings.

How Did Claude Code Expose 2,539 Secrets?

Source: AI Generated Image

The security issue involves Claude Code’s “Yes, and don’t ask again” permission option. The feature allows developers to approve certain shell commands without repeatedly responding to permission requests.

However, when a developer approves an exact command containing a password or API key, Claude Code can save that command in a local configuration file called .claude/settings.local.json.

The problem is that sensitive information entered directly into commands can become part of the saved permission rule.

Apiiro searched public GitHub repositories and discovered:

• 104,185 copies of the settings file.

• 103,617 repositories containing those files.

• 1,122 files containing at least one real secret.

• 1,379 distinct secrets in those files.

The broader investigation, which included older settings versions, shared configuration files, and saved agent transcripts, identified 2,539 secrets across 1,994 repositories.

What Types of Credentials Were Exposed?

The exposed information covered several types of credentials that could potentially provide access to important systems and services.

Database credentials represented a significant portion of the findings. More than one third of the exposed files opened a database directly.

Apiiro identified:

• 379 database passwords.

• 122 Supabase service role keys.

• 43 SSH logins for public servers, including some root passwords.

• 42 GitHub, GitLab, and npm tokens.

• 23 AWS keys.

Some affected organisations also had particularly sensitive exposures. Examples included a database vendor’s cloud API key with management access, a software agency’s production Square token, and the owner password for a medical records application’s cloud database.

Apiiro did not test whether every credential remained active. However, one organisation confirmed that a key reported by the researchers was still live.

These findings show why developers should treat configuration files as potentially sensitive, even when they appear to contain only ordinary project settings.

How Did Anthropic Respond to the Claude Code Security Issue?

Apiiro shared its findings with Anthropic before publication. Boris Cherny, head of Claude Code, acknowledged the issue during a discussion on Hacker News.

Cherny said the company was investigating possible protections, including making auto mode catch sensitive commands and introducing basic secret scanning.

However, these changes may not completely solve the problem. During the discussion, a reader pointed out that similar exposure could also happen in auto mode. Cherny acknowledged the concern.

Another issue is the effectiveness of existing security scanners.

Apiiro tested two tools against the exposed files:

• Gitleaks detected 564 files containing secrets.

• TruffleHog detected 643 files.

• Both tools missed 215 files.

This means developers cannot assume that running a secret scanner will identify every exposed credential.

For anyone managing digital assets or trading accounts, credential protection is equally important. Bitrue provides a platform for buying, selling, and trading cryptocurrencies.

Register on Bitrue to explore its crypto trading services while maintaining strong security practices for your accounts and API credentials.

Why Is This a Bigger Risk for AI Coding Agents?

The Claude Code incident highlights a broader concern surrounding AI coding agent risks: convenience features can create security problems when sensitive information is stored without proper protection.

Developers often approve commands to save time, especially when working on repetitive tasks.

However, entering passwords or tokens directly into commands can leave those credentials inside local configuration files.

The risk also extends beyond public GitHub repositories.

Because the settings file is stored as plain JSON on developer machines, malware could potentially search for it and extract credentials.

The Shai-Hulud npm worm, which ran TruffleHog across victims’ files in September 2025, demonstrates why local credential storage deserves attention.

Previous reports had also raised concerns about this issue. Claude Code users reported similar problems through GitHub issues starting in August 2025.

In April, Lakera identified credentials in 33 files across 30 packages published to npm.

How Can Developers Protect Their Claude Code Credentials?

Developers should review their Claude Code settings and take action if sensitive information has been exposed.

Apiiro recommends several practical steps:

• Rotate exposed credentials: Replace every credential that appeared in affected files, including older versions.

• Remove tracked settings files: Stop tracking .claude/settings.local.json in Git repositories.

• Update .gitignore: Add the local settings file to each repository’s ignore rules.

• Use environment variables: Reference secrets through environment variables instead of typing them directly into commands.

• Approve command patterns: Use general permission patterns rather than saving exact commands containing sensitive values.

Importantly, simply deleting an exposed file is not enough. Credentials may remain accessible through Git history, forks, and existing repository clones.

Developers should also review shared settings files and saved agent transcripts for accidental credential exposure.

Conclusion

The Claude Code security issue shows how a small convenience feature can create significant risks when sensitive credentials are stored in plain text.

Apiiro’s discovery of 2,539 secrets across 1,994 repositories highlights the importance of secure configuration management, credential rotation, and regular repository checks.

Anthropic is exploring additional protections, but developers still need to take responsibility for their own security practices.

For cryptocurrency users, protecting account access is equally important. Bitrue offers an accessible platform for easier and safer crypto trading.

FAQ

What is the Claude Code security issue?

It involves a permission feature that could save commands containing passwords, API keys, and other credentials in plain text within local settings files.

How many secrets did Apiiro discover?

Apiiro’s broader investigation identified 2,539 secrets across 1,994 GitHub repositories.

What is the .claude/settings.local.json file?

It is a local Claude Code configuration file that can store permission rules. Sensitive information may appear when exact commands containing credentials are saved.

Has Anthropic fixed the Claude Code vulnerability?

Anthropic acknowledged the issue and is exploring protections such as secret scanning and additional checks in auto mode. The proposed measures may not prevent every form of exposure.

What should developers do if their Claude Code secrets were exposed?

Developers should rotate affected credentials, remove sensitive files from repository tracking, update .gitignore, and use environment variables instead of entering secrets directly into commands.

Disclaimer: The views expressed belong exclusively to the author and do not reflect the views of this platform. This platform and its affiliates disclaim any responsibility for the accuracy or suitability of the information provided. It is for informational purposes only and not intended as financial or investment advice.