When Claude Code asks permission to run a command, one answer is “Yes, and don’t ask again.” Security firm Apiiro says that choice saves the exact command to .claude/settings.local.json in your project folder. If the command contained a password or API key, the secret is saved with it.

Apiiro’s research, published November 5, found that the file regularly gets committed, meaning saved into the project’s git history, and pushed to public GitHub repositories. Of 104,185 public copies, 1,122 held a real secret. Counting git history and other files, Apiiro found 2,539 real secrets across 1,994 public repositories. They include database passwords, cloud keys, API tokens and SSH root logins.

How a password gets into the file

Say you ask Claude Code to find out why login fails on staging. It proposes a command that connects to your database, and your password is part of that command because the command cannot work without it. You approve it with “don’t ask again” so the interruptions stop.

Claude Code then stores the whole command as a permission rule. Apiiro notes that after many approval prompts most people stop reading the commands, and a secret is one word in a long line. Apiiro says it reproduced the behavior with Opus 5.5 and Fable 5.1, and describes it as Claude Code’s own behavior rather than the model’s.

The file is meant to stay on your machine. Apiiro says Claude Code adds it to your global git ignore list, which tells git on your computer to skip it. That does not cover a folder that becomes a repository later, a clone on another computer, or a file someone already committed. The project’s own .gitignore is never updated, so nothing in the repository protects the file.

Claude often commits the file itself. In 539 of the 1,105 repositories with a real secret that Apiiro traced, a commit co-authored by Claude changed the file. Apiiro says Claude Code’s commit instructions tell the model not to commit .env or credentials.json, but do not list its own settings file.

What to check and what to do

Apiiro lists three checks:

  • Is it public? Search your GitHub organization for .claude/settings.local.json and .claude/settings.json. Anyone can read each hit.
  • Was it ever committed? Look in each repository’s history for the file, even if it is gone today. Every fork and clone keeps the old copy.
  • What is in it? Open the allow list in each copy on your machine. Every entry is a command you approved, with whatever you typed into it, so look for passwords, tokens, keys and connection strings.

If you find a secret, Apiiro says to rotate it first and clean up second. Rotating means issuing a new password or key and revoking the old one. Deleting the file does not help, because anyone who already copied it still has the old secret.

Before you pick “don’t ask again” on a command, read it for anything that looks like a password or key. Two other places where credentials can sit unencrypted on your machine are Claude Code’s MCP login tokens and its local session transcripts.

Anthropic’s response

Boris Cherny, whom Apiiro identifies as Anthropic’s head of Claude Code, replied on Hacker News on November 7. Apiiro’s November 8 update quotes him saying the team is “looking into what we can do to prevent this.” He named two approaches to prototype: making sure auto mode catches this, and building in basic secret scanning. Both are plans to prototype, not shipped changes, so for now the check above is the protection.

End of article