Claude Code's 'Don't Ask Again' Saved Passwords in Plain Text: 1,122 Public settings.local.json Files on GitHub Hold 1,379 Secrets
Researchers found that Claude Code stores approved commands verbatim in .claude/settings.local.json, leaking database passwords, SSH logins and cloud keys into public GitHub repositories, with 215 files slipping past both gitleaks and TruffleHog.
The convenience button in AI coding agents has turned into a credential leak. Security researchers have found that Claude Code's "Yes, and don't ask again" option saves approved shell commands, including any passwords or tokens typed into them, in a plain-text project file. That file has ended up on public GitHub by the thousands. Of more than 104,000 public copies they examined, 1,122 contained at least one real-looking secret.
What Happened
When a developer approves a command in Claude Code and picks "don't ask again", the agent writes an allow rule into .claude/settings.local.json inside the project. That way the same command runs without prompting next time. If the approved command was one exact command line, the rule stores it word for word. Commands like these:
PGPASSWORD=<password> psql -h db.example[.]com ...
sshpass -p <password> ssh deploy@203.0.113[.]10
mysql -u root -p<password> ...become permanent entries in a JSON file in the repository folder. The researchers reproduced the behaviour with current models.
Technical Details
Claude Code does try to keep the file out of git. The first time it writes settings.local.json in a repository, it adds the file to the user's global git excludes. The researchers point out three gaps:
- Global excludes do nothing for a file that was already committed.
- The file is not added to the project's own
.gitignore, so the protection doesn't travel with the repository to other machines, CI runners or colleagues. - In 539 of 1,105 repositories traced, a commit listing Claude as co-author changed the file. That suggests the agent often commits it itself.
The numbers from the study:
- 104,185 public copies of
settings.local.jsonacross 103,617 repositories. - 1,122 files with at least one secret, holding 1,379 distinct secrets.
- More than a third open a database directly, including 379 database passwords. There were also 43 SSH logins to public servers, 42 GitHub/GitLab/npm tokens and 23 AWS keys.
- Owners included 63 organisations, mostly software companies. The worst cases included a database vendor's admin-level cloud key and the owner password of a medical-records database.
- Counting the shared
.claude/settings.json, older file versions in git history and saved agent chat logs, the total rises to 2,539 secrets across 1,994 repositories.
The researchers did not test whether the secrets work. One notified company confirmed its key was live. There is no public evidence that anyone has abused them yet.
Why Scanners Missed Them
Standard secret scanners caught only about half. When gitleaks and TruffleHog were run without verification, they flagged 564 and 643 of the 1,122 files, and 215 files slipped past both. Most of the misses were passwords embedded in command text, such as after PGPASSWORD=, sshpass -p or mysql -p. They don't match a known key format, so scanners read them as ordinary strings.
Who Is Affected
Any developer or team using Claude Code who has approved a command containing a literal credential, especially in repositories that are public, forked or published as packages. Among 16 coding agents whose documentation was compared, Claude Code was the only one confirmed to store the full approved command in a project file by default. The file can also leak outside git, into npm packages, Docker images, zip archives and synced folders.
Vendor Response
The researchers say a bug report describing the same behaviour (issue #5544) was filed in August 2025 and closed automatically as "not planned" after 60 days without activity. Four related reports met the same fate, none with a reply from Anthropic. No public statement from Anthropic was available at the time of writing.
What To Do Now
For developers:
- Search your organisation for both
.claude/settings.local.jsonand.claude/settings.json, including git history and forks. - Rotate first, then clean up. Deleting the file doesn't remove it from history or forks.
- Stop tracking the local file and ignore it per-repository:
git rm --cached .claude/settings.local.json
echo ".claude/settings.local.json" >> .gitignore
git log --all --oneline -- .claude/settings.local.json # find historic copies- Open the local file on your own machine and delete any rule that contains a secret, even if it was never committed.
- Keep secrets out of commands. Use environment variables from a secrets manager (for example
$DB_URL) so only the variable name is saved. - Approve patterns such as
Bash(npm run:*)instead of one-off commands.
For security teams: treat agent folders (.claude/, .cursor/, .gemini/, .specstory/) like .env files. Add them to pre-commit and CI secret scanning, extend rules to catch passwords inside command lines, and add .claude/settings.local.json to organisation .gitignore templates.
Why It Matters
AI coding agents now keep their own state (permissions, memories, transcripts) next to the code, and that state picks up whatever the developer typed. The leak here comes from a usability feature, not a vulnerability in the usual sense. That is why it went unnoticed for so long. As agents take on more work, the files they write deserve the same suspicion as configuration files and logs.
