Claude Code's "Don't Ask Again" Setting Is Quietly Leaking Your Secrets

Robert Moore · 2026-11-07

You know that little checkbox that saves you a few keystrokes? The one that says "Yes, and don't ask again"? Well, it turns out that convenience has a price. And in this case, the price might be your API keys, your passwords, and whatever else you thought was safely tucked away in your terminal. Here's the deal. When you approve a command in Claude Code, Anthropic's AI coding assistant, and you tell it not to bug you about that command again, it saves the command word-for-word. That includes any secrets you typed into it. Then it stashes that command in a project settings file. And if that file ends up in a public GitHub repo, well, anyone can read it. Security researchers at Apiiro found 1,122 public GitHub repositories where exactly this happened. Over a thousand copies of people's secrets, sitting out in the open. No hacking required. No clever exploit. Just a helpful feature doing exactly what it was told to do. ### Why This Happens (And Why It's So Easy to Miss) Think of it like writing your ATM PIN on a sticky note and then taping that note to your monitor. The note isn't doing anything wrong. It's just sitting there. But everyone who walks by can see it. That's essentially what's happening here. Developers run a command with a password or an API key in it. Claude Code asks, "Can I run this?" The developer says yes, and clicks "don't ask again." The command gets saved to a local settings file, usually something like `.claude/settings.local.json`. Then, when the developer pushes their project to GitHub, that settings file goes along for the ride. And here's the kicker: most people don't even realize it's happening. The file doesn't scream "I contain secrets." It just looks like another config file in a sea of config files. ### What Apiiro Actually Found Apiiro's scan turned up 1,122 public repositories with exposed credentials. That's not a rounding error. That's over a thousand projects where someone's keys, tokens, or passwords are readable by anyone with a browser and a bit of curiosity. > "The convenience of automation often comes at the cost of visibility. When tools save commands for you, they also save whatever you put inside those commands." — a lesson worth taping to your monitor The types of secrets exposed run the usual gamut: - API keys for cloud services - Database passwords - Access tokens for third-party platforms - Private keys that should never see daylight ### What You Should Do Right Now If you use Claude Code, or really any AI coding assistant that remembers commands, take five minutes today and do a quick audit. - Check your project for a `.claude` folder and look inside `settings.local.json` - Search your repos for anything that looks like a secret typed into a command - Add settings files to your `.gitignore` before your next push - Rotate any key or password that might have been exposed The last one matters most. Even if you delete the file, the secret is still in your git history. If it was public for even an hour, assume it's compromised. ### The Bigger Lesson This isn't really a Claude Code problem. It's a human problem. We all love convenience. We all click "don't ask again" because we're busy and we trust the tools we use. But trust without verification is how secrets end up on the internet. So the next time a tool offers to remember something for you, ask yourself one question: would I be okay if this got posted publicly? If the answer is no, don't let it get saved. Or better yet, don't put the secret in the command in the first place. Use environment variables. Use a secrets manager. Do anything other than typing your password into a terminal and hoping for the best.