---
id: "TECH-202611-bvpxa6"
page: "https://infrastack.ai/live/TECH-202611-bvpxa6"
kind: "technique"
aliases: []
title: "Claude Code's 'Yes, and don't ask again' saves approved commands, with any password or token in them, in plain text in .claude/settings.local.json, which ends up committed to public GitHub repos (Apiiro)"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "Claude Code", "fixed": [], "vendor": "Anthropic"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-07T07:29:04+00:00"
updated_at: "2026-11-07T07:30:52+00:00"
sources: [{"source": "analyst", "url": "https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html", "first_seen_at": "2026-11-07T07:29:04+00:00", "cites": ["https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html"]}]
exploit_sources: []
---

# Claude Code's 'Yes, and don't ask again' saves approved commands, with any password or token in them, in plain text in .claude/settings.local.json, which ends up committed to public GitHub repos (Apiiro)

Link for people: https://infrastack.ai/live/TECH-202611-bvpxa6 (this .md is for agents)

When a Claude Code user approves a shell command with 'Yes, and don't ask again', Claude Code can store the exact command, including any password, token or key typed in it, in plain text in the project file .claude/settings.local.json. Claude Code only adds this file to the user's global git excludes on that one machine, never to the project's .gitignore, and Claude often commits the file itself. Apiiro (research published 5 Nov 2026) found 104,185 public copies on GitHub; 1,122 hold 1,379 secrets (379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens, 23 AWS keys) from 63 organisations, plus 734 more in git history, 211 forks and committed .claude/settings.json files: 2,539 secrets in 1,994 repos in total. One notified company confirmed its key was live. No reports of anyone abusing these secrets yet. Earlier bug reports (since 11 Aug 2025) were closed by a bot as 'not planned'; Anthropic has not responded and there is no fix.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Claude Code affected range not listed fixed no fixed version listed

## How to check

Search your GitHub org (code and git history, including forks) and your laptops, npm packages, Docker images and archives for .claude/settings.local.json and .claude/settings.json. Look in permission allow rules for secrets in commands, especially passwords after PGPASSWORD=, sshpass -p and mysql -p, database connection URLs, and SSH, AWS, GitHub, GitLab or npm tokens. gitleaks and TruffleHog miss many of these (neither flagged 215 of the 1,122 files).

## Fix

Rotate every password, token and key these files have ever held first, then clean up: git rm --cached .claude/settings.local.json, add it to the repo's .gitignore and your org's .gitignore templates, and delete secret-containing rules from local copies. Keep secrets out of commands (use variables like $DB_URL from a secrets manager) and approve patterns such as Bash(npm run:*) instead of exact commands. Add agent folders (.claude/, .cursor/, .gemini/, .specstory/) to pre-commit and CI secret scanning, including history and passwords inside commands.

## Timeline

- 2026-11-07T07:29:04+00:00 analyst https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html

## Documents

- [describes] @TheHackersNews: ‼️ Claude Code's "Don't Ask Again" option can save passwords and API keys in pla https://x.com/TheHackersNews/status/2118960196987080801
- [describes] Claude Code's 'Don't Ask Again' File Exposes Passwords and Keys in 1,122 Public Copies on GitHub https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_