Bitwarden vs 1Password: Claude Code Secrets Security Setup

The best Claude Code secrets security setup for a freelancer is free: rotate any credential you have typed into an approved command, add .claude/settings.local.json to each project's own .gitignore, and stop approving exact commands. If you also want a paid layer that keeps passwords out of commands altogether, Bitwarden Teams wins for teams of six or fewer, and the 1Password Teams Starter Pack wins from seven seats upward, going by Bitwarden's and 1Password's published prices.

The urgency comes from research published on 5 November 2026. Security firm Apiiro scanned public GitHub and found 104,185 copies of Claude Code's local settings file across 103,617 repositories, and 1,122 of those files held a real secret.

TL;DR

• Claude Code's "Yes, and don't ask again" choice saves the exact approved command, including any password inside it, to .claude/settings.local.json (Apiiro).
• The only built-in protection is a global git exclude on your own machine, so clones, forks and new repositories are not covered (Anthropic settings docs).
• Rotate first, clean up second. Deleting the file does not remove older versions from git history.
• Bitwarden Teams is the cheaper paid option for up to six people; 1Password Teams Starter Pack is cheaper for seven to ten.
• The audit below takes about 30 minutes per client repository once you have done it twice.

What exactly goes wrong with "don't ask again"?

When you approve a shell command and choose the "don't ask again" option, Claude Code stores that exact command as an allow rule in .claude/settings.local.json inside the project. If the command contained PGPASSWORD=, sshpass -p or a bearer header, the credential sits in that plain JSON file word for word (Apiiro).

A rule might look like this:

{
  "permissions": {
    "allow": [
      "Bash(PGPASSWORD=<real-password-here> psql -h db.client-example.com -U app -c 'select 1')"
    ]
  }
}

The file is meant to stay local. Claude Code adds **/.claude/settings.local.json to your user-level global git excludes the first time it writes the file in a repository, but it does not touch the project's own .gitignore (Anthropic settings docs; Apiiro). A collaborator, a fresh laptop or a folder that becomes a repository later has no such exclude.

How big is the exposure, and is it proven harm?

Of the 1,122 files with a real secret, Apiiro counted 1,379 distinct secrets, and widening the search to git history, shared settings and agent transcripts raised the total to 2,539 secrets across 1,994 repositories (Apiiro). The largest groups were 379 database passwords and 122 Supabase service-role keys.

This is an exposure finding, not a proven breach. Apiiro did not test whether the secrets still worked, though one notified company confirmed its exposed key was live (Apiiro; The Hacker News covered the findings on 7 November 2026). As of 8 November 2026 I found no public statement from Anthropic, and an earlier GitHub report of the same behaviour was closed as "not planned" by a stale-issue bot (Apiiro). Plan on fixing this yourself.

Will gitleaks or TruffleHog catch it?

Only partly. In Apiiro's data, gitleaks flagged 564 of the 1,122 files and TruffleHog flagged 643, while 215 files escaped both (Apiiro). Both tools lean on known key formats, and a password typed after PGPASSWORD= has no recognisable shape.

Both scanners are free to run locally, so keep them in your routine. Then open the settings file by hand and read every allow rule, because that is the part the scanners miss.

How do I run a 30-minute Claude Code secrets security setup audit?

Work through each client repository in this order. The time split is my own budget, not a benchmark. The remediation steps follow Apiiro's guidance.

1. Search (5 minutes). In GitHub code search, look for path:.claude/settings.local.json and path:.claude/settings.json across your organisation. Locally, run git log --all --oneline -- .claude/ to see whether the file was ever committed.
2. Rotate (10 minutes). Change every password, token and key the file has ever held, including values only present in old commits. Do this before any cleanup.
3. Untrack and ignore (5 minutes). Run git rm --cached .claude/settings.local.json, then add .claude/settings.local.json to the repository's .gitignore and commit.
4. Prune rules (5 minutes). Delete every allow rule containing a secret from the local file.
5. Change the habit (5 minutes). Approve patterns such as Bash(npm run:*) rather than whole commands, and read credentials from environment variables or a secrets manager.

Treat .claude/, .cursor/, .gemini/ and .specstory/ like .env files: they can end up in backups, Docker images and synced folders.

Should I pay for Bitwarden or 1Password to keep secrets out of commands?

Paying is optional, but a password manager gives you a reference to a secret instead of the secret itself, so a command such as psql can read its password from the environment and the allow rule contains nothing sensitive. Both products offer command-line tools for this; check each vendor's documentation for the exact workflow you plan to use.

Pricing differs in shape. Bitwarden Teams costs $4 per user per month billed annually, about Rs 376 at 94.04 rupees to the dollar. The 1Password Teams Starter Pack is a flat $24.95 per month for up to 10 members billed annually, about Rs 2,350 at the same rate, with extra seats at $4.99 each.

Our analysis of the two published rate cards puts the break-even between six and seven people:

Team size	Bitwarden Teams (monthly, annual billing)	1Password Starter Pack (monthly, annual billing)
3 people	$12, about Rs 1,128	$24.95, about Rs 2,350
6 people	$24	$24.95
7 people	$28	$24.95

Sources: Bitwarden pricing, 1Password pricing. Rupee figures are my conversions at the 6 November 2026 close of 94.04.

Verdict: for a solo freelancer or a two-to-three person shop, Bitwarden Teams is the better buy. For a seven-to-ten person agency, the 1Password flat rate is cheaper. Prices change, so confirm on the vendor pages before you commit.

What else belongs in a small team's setup?

Keep the audit inside a wider routine. If you coordinate Claude Code sessions across clients, the message threads setup guide covers how to keep that work organised, and the piece on subagents and cheaper status updates is useful once your audit becomes routine delegation. Subscription costs matter for small shops too, so see Claude AI Pro pricing in India against Google AI Pro and our expense management software comparison for tracking tool spend.

FAQ

Q: Does deleting .claude/settings.local.json fix the leak?

A: No. Older versions remain in git history and in any forks, so rotate every credential the file ever contained before you clean up (Apiiro).

Q: Is the file ignored by git automatically?

A: Only on the machine where Claude Code created it, through a user-level global exclude. The project's own .gitignore is not changed, so add the entry yourself (Anthropic settings docs).

Q: Are gitleaks and TruffleHog enough on their own?

A: No. Passwords typed inside commands lack recognisable key formats, and 215 of 1,122 affected files evaded both tools in Apiiro's scan (Apiiro). Review the allow rules manually.

Q: Which password manager suits a three-person agency?

A: Bitwarden Teams, at $4 per user per month billed annually, comes to about $12 for three people, against a flat $24.95 for the 1Password Starter Pack (Bitwarden; 1Password).

Q: Do I need to stop using "don't ask again" entirely?

A: Not necessarily. Approve command patterns such as Bash(npm run:*) instead of exact commands, and never let a literal password appear in a command you approve permanently.

Sources

• Apiiro research on coding agents leaking secrets on GitHub
• The Hacker News: Claude Code's don't-ask-again file exposes passwords and keys
• Anthropic Claude Code settings documentation
• Bitwarden pricing
• 1Password pricing

Sham Uddin writes about practical AI tooling for small businesses. Last verified 8 November 2026. This is a software how-to, not legal, tax or investment advice.