DEV Community

Cover image for Developers Clicked 'Don't Ask Again.' Claude Code Saved Their Passwords — and 1,122 of Those Files Are Sitting on Public GitHub.
Faith & Fact - Marky Mark
Faith & Fact - Marky Mark

Posted on Originally published at gangstaai.org

Developers Clicked 'Don't Ask Again.' Claude Code Saved Their Passwords — and 1,122 of Those Files Are Sitting on Public GitHub.

#claudecode #anthropic #security #github

Every well-run home has one rule about keys: you do not leave them in the front door. It turns out thousands of software developers have been doing exactly that, and an AI coding assistant was holding the door open for them.

On November 5, the security firm Apiiro published research on Claude Code's "Yes, and don't ask again" button. That's the option a developer clicks when the assistant wants to run a shell command and they'd rather not be asked a second time. Apiiro found that when the approved command contains a password or an API key, Claude Code saves the entire command, secret included, as a permanent allow rule in a small file called .claude/settings.local.json.

That file is meant to stay on your laptop. Apiiro went looking for it on public GitHub anyway, and found 104,185 copies across 103,617 repositories.

What was in the files

  • 1,122 files held real-looking secrets: 1,379 distinct credentials in the current versions alone.
  • Counting older commits, shared settings.json files and saved agent transcripts, the total rose to 2,539 secrets across 1,994 repositories.
  • Apiiro tied the exposure to 63 organizations, mostly software companies. One confirmed its leaked key had been live.
  • Databases took the worst of it: 379 database passwords and 122 Supabase service-role keys, plus 23 AWS keys and 43 SSH logins, some of them root passwords.
  • Forks did the rest. Credentials from 74 repositories had already been copied into 211 more repositories.

The uncomfortable part is that nothing malicious happened here. There was no hack, no stolen account and no poisoned prompt. A developer asked for help connecting to a database, the assistant wrote a command containing the password, and the developer clicked the polite, time-saving button.

The convenience setting became a filing cabinet, and someone left the drawer facing the street.

The safeguards everyone assumed were there

Claude Code does try. When it first creates the file inside a Git repository, it adds the file to the developer's global Git ignore list. But that rule lives on one person's machine. It doesn't travel with the project, it doesn't cover files that were already tracked, and it doesn't reliably cover a folder that only became a repository later. Anthropic's own permissions documentation confirms that approvals persist across sessions, and Cybersecurity News reports that a GitHub issue flagged plaintext credentials in approved commands as early as August 2025.

The backup plan didn't hold up either. Of the 1,122 files, Gitleaks flagged 564 and TruffleHog flagged 643. Neither tool caught 215 of them. A password typed after PGPASSWORD= or sshpass -p doesn't have a recognizable vendor prefix, so pattern-matching scanners walk right past it. (Apiiro notes it didn't test whether the credentials worked. "Real" means credible credential material, not confirmed access.)

If you use any coding agent, the cleanup order matters: rotate the credentials first, then delete. Removing the file today leaves every old commit and fork intact. After that, untrack the settings file, add it to the repository's own .gitignore, and keep secrets in a secret manager rather than in commands.

Don't switch off your second opinion

The lesson here goes beyond one settings file. The approval prompt existed to put a second set of eyes on what the AI was about to do, and "don't ask again" quietly removed it. Then the tool everyone trusted to catch mistakes turned out to be one tool's opinion as well, and it missed a fifth of the problem.

Your answers deserve the same care. Every frontier model, including ChatGPT, Claude, Gemini and Grok, is confidently wrong about something, and no single model is reliably best for long. Gangsta AI asks the same question of all of them and 30+ more at once, then gives you one cross-checked answer with the disagreements left in view. When the models disagree, that's your sign to look again before you act.

A tidy house has a second lock and someone who checks it. If you want to know which model is best at what before you trust one, start with our guide to the best AI models. It's a good thing.

Sources

Originally published on Gangsta AI News. Gangsta AI lets you compare 30+ AI models side by side on a single prompt — free, no login. Try the AI model comparison tool.

Top comments (0)