1,379 Passwords on GitHub: Claude Code’s ‘Don’t Ask Again’ Approval Files Leaked Live Credentials

If you have ever told an AI coding agent “yes, and don’t ask again,” the command you approved may have been saved to disk in plain text — including any password you typed into it. Researchers at Apiiro found 1,379 such credentials sitting in 1,122 public GitHub repositories. Anthropic’s Claude Code head says the team is finally looking into fixes. How a secret ends up in a public repo By default, Claude Code asks before it runs most shell commands. When you approve a command, the approval dialog offers an option along the lines of “Yes, and don’t ask again.” That option writes the command into an allow rule in .claude/settings.local.json — and if the command included a password, token, or API key typed directly on the command line, the secret goes with it. Anthropic’s own settings documentation says Claude Code adds that file to your global Git exclusions when it creates it. The problem is that a global exclusion lives on your computer, not in the project.

This excerpt comes from the named source. Read the original for the full reporting.