GoKawiilClaude Code's permission-skipping feature exposed credentials in public repos, Apiiro finds
Security firm Apiiro reports that Claude Code's 'don't ask again' option, used to bypass repeated permission prompts for shell commands, saves the exact command—including any embedded passwords or API keys—to a local settings file. Apiiro found this file in over 100,000 public GitHub repositories, with roughly 1,100 containing exposed secrets from 63 organizations, including API tokens, database passwords, private keys and root logins.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw stems from a protective measure—adding the file to a global Git ignore list—that only works on the original machine and fails once a repo is cloned, forked, or built from a folder that predates the setting, meaning the safeguard Anthropic describes in its documentation does not reliably travel with the code. Apiiro's finding that 215 of the exposed secrets evaded standard scanners suggests existing detection tooling may be insufficiently tuned to this specific exposure pattern, and that deleting an offending file does not remove credentials already copied into forks.
- Claude Code's 'don't ask again' option can store full shell commands, including credentials, in a local JSON settings file.
- Apiiro found the file in 100,000+ public repos, with about 1,100 exposing real secrets from 63 organizations.
- Standard secret scanners missed 215 of the exposed credentials, and deleting the file doesn't remove copies in existing forks.
YubiKey 5C NFC security key — When API keys and passwords leak from careless config files, hardware-backed authentication is your last line of defense. A YubiKey lets you enforce phishing-resistant, non-exportable credentials for GitHub and cloud accounts so a leaked secret alone can't be used to take over your developer accounts. It's a simple way to harden your workflow against exactly the kind of credential exposure described in this article.
See YubiKey 5C NFC security key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: techspot.com — Skye Jacobs, 2026-11-10
Published there as: “Claude Code's "don't ask again" button is leaking passwords and API keys to public GitHub repos”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.