{"id":"TECH-202611-bvpxa6","kind":"technique","aliases":[],"related":[],"title":"Claude Code's 'Yes, and don't ask again' saves approved commands, with any password or token in them, in plain text in .claude/settings.local.json, which ends up committed to public GitHub repos (Apiiro)","description":null,"summary":"When a Claude Code user approves a shell command with 'Yes, and don't ask again', Claude Code can store the exact command, including any password, token or key typed in it, in plain text in the project file .claude/settings.local.json. Claude Code only adds this file to the user's global git excludes on that one machine, never to the project's .gitignore, and Claude often commits the file itself. Apiiro (research published 5 Nov 2026) found 104,185 public copies on GitHub; 1,122 hold 1,379 secrets (379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens, 23 AWS keys) from 63 organisations, plus 734 more in git history, 211 forks and committed .claude/settings.json files: 2,539 secrets in 1,994 repos in total. One notified company confirmed its key was live. No reports of anyone abusing these secrets yet. Earlier bug reports (since 11 Aug 2025) were closed by a bot as 'not planned'; Anthropic has not responded and there is no fix.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Claude Code","fixed":[],"vendor":"Anthropic"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"Search your GitHub org (code and git history, including forks) and your laptops, npm packages, Docker images and archives for .claude/settings.local.json and .claude/settings.json. Look in permission allow rules for secrets in commands, especially passwords after PGPASSWORD=, sshpass -p and mysql -p, database connection URLs, and SSH, AWS, GitHub, GitLab or npm tokens. gitleaks and TruffleHog miss many of these (neither flagged 215 of the 1,122 files).","fix":"Rotate every password, token and key these files have ever held first, then clean up: git rm --cached .claude/settings.local.json, add it to the repo's .gitignore and your org's .gitignore templates, and delete secret-containing rules from local copies. Keep secrets out of commands (use variables like $DB_URL from a secrets manager) and approve patterns such as Bash(npm run:*) instead of exact commands. Add agent folders (.claude/, .cursor/, .gemini/, .specstory/) to pre-commit and CI secret scanning, including history and passwords inside commands.","status":"open","published_at":null,"first_seen_at":"2026-11-07T07:29:04+00:00","triaged_at":"2026-11-07T07:29:04+00:00","updated_at":"2026-11-07T07:30:52+00:00","category":"ai-tooling","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':35A '1':126B,129B,163B '104':120B '11':188B '122':127B '185':121B '2':159B '2025':190B '2026':118B '211':153B '23':141B '379':130B,132B '42':138B '43':135B '5':116B '539':160B '63':145B '734':148B '994':164B 'abus':180B 'add':86B 'anthrop':199B 'anyon':179B 'apiiro':33A,113B 'approv':11A,48B 'ask':8A,57B 'aug':189B 'aw':142B 'bot':195B 'bug':185B 'bvpxa6':36A 'claud':1A,45B,59B,83B,107B 'claude':37A 'claude/settings.json':157B 'claude/settings.local.json':24A,82B 'close':192B 'code':2A,38A,46B,60B,84B 'command':12A,51B,65B 'commit':28A,109B,156B 'compani':170B 'confirm':171B 'copi':123B 'databas':133B 'earli':40B 'earlier':184B 'early-warn':39B 'end':26A 'exact':64B 'exclud':95B 'file':81B,88B,111B,158B 'fix':207B 'fork':154B 'found':119B 'git':94B,151B 'github':31A,125B 'github/gitlab/npm':139B 'gitignor':105B 'global':93B 'histori':152B 'hold':128B 'includ':66B 'key':71B,143B,173B 'live':175B 'login':137B 'machin':99B 'never':100B 'notifi':169B 'nov':117B 'often':108B 'one':98B,168B 'organis':146B 'password':15A,68B,134B 'plain':21A,76B 'plan':198B 'plus':147B 'project':80B,103B 'public':30A,122B 'publish':115B 'repo':32A,165B 'report':177B,186B 'research':114B 'respond':202B 'save':10A 'secret':131B,161B,182B 'shell':50B 'sinc':187B 'ssh':136B 'store':62B 'tech':34A 'techniqu':42B 'text':22A,77B 'token':17A,69B,140B 'total':167B 'type':72B 'user':47B,91B 'warn':41B 'yes':4A,53B 'yet':183B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["claudecode","code"],"ptokens":["claude","code"],"labels":["aitooling","earlywarning","high","technique"],"campaign_type":"exploitation","search_a":"'-202611':35A 'apiiro':33A 'approv':11A 'ask':8A 'bvpxa6':36A 'claud':1A 'claude':37A 'claude/settings.local.json':24A 'code':2A,38A 'command':12A 'commit':28A 'end':26A 'github':31A 'password':15A 'plain':21A 'public':30A 'repo':32A 'save':10A 'tech':34A 'text':22A 'token':17A 'yes':4A","search_b":"'1':126B,129B,163B '104':120B '11':188B '122':127B '185':121B '2':159B '2025':190B '2026':118B '211':153B '23':141B '379':130B,132B '42':138B '43':135B '5':116B '539':160B '63':145B '734':148B '994':164B 'abus':180B 'add':86B 'anthrop':199B 'anyon':179B 'apiiro':113B 'approv':48B 'ask':57B 'aug':189B 'aw':142B 'bot':195B 'bug':185B 'claud':45B,59B,83B,107B 'claude/settings.json':157B 'claude/settings.local.json':82B 'close':192B 'code':46B,60B,84B 'command':51B,65B 'commit':109B,156B 'compani':170B 'confirm':171B 'copi':123B 'databas':133B 'earli':40B 'earlier':184B 'early-warn':39B 'exact':64B 'exclud':95B 'file':81B,88B,111B,158B 'fix':207B 'fork':154B 'found':119B 'git':94B,151B 'github':125B 'github/gitlab/npm':139B 'gitignor':105B 'global':93B 'histori':152B 'hold':128B 'includ':66B 'key':71B,143B,173B 'live':175B 'login':137B 'machin':99B 'never':100B 'notifi':169B 'nov':117B 'often':108B 'one':98B,168B 'organis':146B 'password':68B,134B 'plain':76B 'plan':198B 'plus':147B 'project':80B,103B 'public':122B 'publish':115B 'repo':165B 'report':177B,186B 'research':114B 'respond':202B 'secret':131B,161B,182B 'shell':50B 'sinc':187B 'ssh':136B 'store':62B 'techniqu':42B 'text':77B 'token':69B,140B 'total':167B 'type':72B 'user':47B,91B 'warn':41B 'yes':53B 'yet':183B","search_c":"","first_public_at":"2026-11-07T06:44:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-bvpxa6","url":"https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-07T07:29:04+00:00","fetched_at":"2026-11-07T07:29:04+00:00","note":null,"cites":["https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html"]}],"documents":[{"id":93681,"url":"https://x.com/TheHackersNews/status/2118960196987080801","title":"@TheHackersNews: ‼️ Claude Code's \"Don't Ask Again\" option can save passwords and API keys in pla","kind":"post","source":"x","publisher":null,"text":"‼️ Claude Code's \"Don't Ask Again\" option can save passwords and API keys in plaintext.\n\nApiiro found 2,539 exposed secrets across 1,994 public GitHub repos, including database credentials, SSH logins, and cloud keys.\n\nDeleting files doesn't erase Git history.\n\nRead: https://t.co/LyPZ5RaqOZ\n\nlikes 35 reposts 7","published_at":"2026-11-07T06:54:13+00:00","relation":"describes","confidence":null,"note":null},{"id":93834,"url":"https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html","title":"Claude Code's 'Don't Ask Again' File Exposes Passwords and Keys in 1,122 Public Copies on GitHub","kind":"blog","source":"analyst","publisher":null,"text":"The Hacker News report on Apiiro research (Shmulik Cohen, Matan Giladi, published 5 Nov 2026). When a user picks 'Yes, and don't ask again', Claude Code can save the exact approved shell command, including any password or token in it, in plain text in .claude/settings.local.json. Claude Code adds the file only to the user's global git excludes, never to the project .gitignore, and Claude often commits the file itself (539 of 1,105 traced repos). Apiiro found 104,185 public copies of the file; 1,122 hold 1,379 secrets (379 DB passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens, 23 AWS keys), 63 organisations. 734 more secrets in git history, 211 forks, 298 committed .claude/settings.json copies; 2,539 secrets in 1,994 repos in total. One notified company confirmed its key was live; no evidence of abuse. gitleaks and TruffleHog missed 215 files (passwords after PGPASSWORD=, sshpass -p, mysql -p). Related bug reports since 11 Aug 2025 were closed by a bot as not planned; no reply from Anthropic. Fix: search org for .claude/settings.local.json and .claude/settings.json incl. history, rotate secrets first, git rm --cached and add to .gitignore, remove secret-containing rules locally, use env vars, approve patterns.","published_at":"2026-11-07T06:44:00+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}