Claude Code 'Don't Ask Again' Feature Exposed 31,000 Secrets on GitHub

A single convenience feature in Anthropic's Claude Code has leaked 31,088 distinct secrets — including 5,343 that were still valid at the time of detection — into 23,276 public GitHub repositories, according to code security firm GitGuardian.

The exposure stems from the file .claude/settings.local.json, a project-level configuration file Claude Code uses to store local command permissions. The credentials found inside it include database connection strings, cloud provider tokens, SSH passwords, Google API keys and AU service credentials.

The scale is not static. "Monthly leaks in settings.local.json peaked at 12,535 occurrences in April 2026, then fell to 959 by October, and we do not yet know what changed," GitGuardian researcher Guillaume Valadon said in a blog post.

Put plainly: in a single month, more than twelve thousand credential-bearing entries appeared in public repos.

How does an approval button spill secrets?

Claude Code asks developers for permission before executing certain shell commands. When a developer selects the "Yes, and don't ask again" option, the tool writes an allow rule into .claude/settings.local.json.

The mechanism has a flaw. The saved rule contains the actual command string — including any credentials embedded in it. If a developer approves a curl command carrying an API key in its HTTP header, Claude Code stores that entire command as an approved rule, leaving the credential sitting in the file.

Claude Code does add the file to its local Git ignore settings automatically. But that protection does not carry over to other machines or repositories, Valadon said. Developers can accidentally commit the file when working across different clones, or when the file has already been tracked by Git.

How many of the leaked credentials actually work?

Of the occurrences where GitGuardian could establish validity, 67% were working credentials. Database identifiers formed the largest category of valid secrets, with 2,280 distinct credentials, followed by cloud provider tokens and AI tokens.

Traditional defenses would miss much of this. Passwords embedded in command-line arguments and environment variable assignments often lack the recognizable formats that provider-specific secret-scanning rules look for.

What leaked through Docker Hub?

The problem extends beyond GitHub. GitGuardian examined public Docker Hub images and found 613 distinct secrets in Claude Code settings files, 99 of them valid at detection, spread across 543 image repositories and 7,625 tags.

The cause here is Docker's COPY . . instruction, which copies an entire project working directory into an image. Unlike Git, Docker does not respect the repository's .gitignore file — so a configuration file excluded from version control still lands in the container image unless developers explicitly block it via .dockerignore.

The persistence is striking. One valid Cloudflare API token appeared across 559 image tags. A single database password turned up in 643 tags across seven image repositories.

What should security teams do now?

Deleting the file from GitHub does not recall credentials already distributed through published images. GitGuardian advises three actions:

• Rotate every exposed credential.
• Remove sensitive configuration files from both Git and Docker build contexts.
• Check previously published images for lingering secrets.

Longer term, the firm recommends treating AI coding assistant configuration files as secret-bearing assets, scanning them alongside conventional environment files, and using environment variables rather than hardcoding credentials into commands.

Anthropic did not immediately respond to a request for comment. GitGuardian said Claude Code lead Boris Cherny acknowledged the issue, saying the company was looking into it and exploring additional safeguards, including built-in secret scanning and an auto mode.

The takeaway: a developer convenience setting quietly became a credential pipeline into public infrastructure — and rotating keys is now the only reliable fix.