Developers who use Anthropic's Claude Code may have published live passwords and API keys to GitHub without realising it, according to research published on 5 November by security firm Apiiro. The cause is an ordinary approval click, not a hack or a malicious prompt.

When Claude Code proposes a shell command, it asks the developer for permission first. Choosing "Yes, and don't ask again" saves the command word for word — secret included — as an allow rule in a local settings file, .claude/settings.local.json. If that file is later committed and pushed, the credential goes public with the code.

What Apiiro found

Apiiro examined 104,185 public copies of the file on GitHub and found real secrets in 1,122 of them, holding 1,379 distinct credentials. Checking earlier commits, shared settings files and saved agent transcripts raised the total to 2,539 secrets across 1,994 repositories. Sixty-three organisations were affected, mostly software companies. The exposed material included a database vendor's own cloud key, a production Azure PostgreSQL password, a Square production token and the owner password for a medical-records database. One company confirmed its exposed key had been live.

Scanners miss one in five

Standard secret scanners did not catch everything. Gitleaks flagged 564 of the 1,122 files and TruffleHog flagged 643; 215 were flagged by neither, often because the secret was a password typed inside a command rather than a recognisable key. Apiiro did not test the credentials, so the findings show exposure, not proven compromise. The fix is to rotate any exposed credential first, then remove the file from the repository and add it to .gitignore.

[Source: Cyber Security News](https://cybersecuritynews.com/claude-codes-yes-and-dont-ask-again/) | [Source: Apiiro](https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again/)