Claude Code's 'don't ask again' saved some passwords where GitHub could see them, like a spare key under a see-through doormat

What did Apiiro find in Claude Code?

Apiiro found that Claude Code's 'Yes, and don't ask again' approval can save a full command, including any password or key in it, to a file called .claude/settings.local.json. If that file is pushed to a public GitHub project, the password goes public too.

The researchers looked at 104,185 public copies of the file and found secrets in 1,122 of them. Counting Git history, shared settings and saved agent transcripts, they found 2,539 distinct secrets across 1,994 repositories, including 379 database passwords and 23 AWS keys. Apiiro didn't test whether the credentials worked.

Who needs to check, and why didn't Git ignore it?

Anyone whose business code is built with Claude Code needs to check, and that includes the contractor who built your booking app or the owner who vibe coded a quote tool on a weekend.

Claude Code adds the file to the developer's own Git ignore list on their computer. That protection stays on their machine, so when the project moves to another computer or person, the file can be committed like any other.

What should your business do about it?

Your business should ask its developer to search every repository for .claude/settings.local.json and remove it from GitHub.

My advice: deleting the file isn't enough, because old versions stay in the history. Any password or key that ever sat in it should be changed. After that, keep passwords out of commands entirely by storing them in environment files the AI can use without repeating. You don't need to understand any of that yourself, just send this article to whoever does.

'Don't ask again' is a lovely idea. It just shouldn't mean 'don't ask again, and write it on the fridge'.