Don't Ask Again Wrote Your Password Into Git Apiiro Found 2,539 Secrets In Agent Approval Files. Deleting The File Does Not Fix It 104,185 public copies of Claude Code's .claude/settings.local.json sit on GitHub. 1,122 of them, about 1.1%, hold at least one secret. Together those files hold 1,379 distinct values. Counting git history, shared settings and agent transcripts, Apiiro reaches 2,539 distinct secrets across 1,994 repositories. ---------------------- So who paid for the convenience of never being asked twice? 👇 🔹What Actually Gets Saved🔹 Claude Code asks before most shell commands. Pick "Yes, and don't ask again" and it can store the exact command as an allow rule in .claude/settings.local.json. If that command carried a password, a token or a key, the rule carries it too. In plain text. Apiiro reproduced this with Opus 5.5 and Fable 5.1. An ordinary approval, not a jailbreak. 🔹Why The Local File Still Goes Public🔹 On first write inside a git repo, Claude Code can add the file to the developer's global git excludes. That lives on one machine. It does not travel with the project, and it does not cover a file already tracked. The tool never writes the ignore into the repo's own .gitignore. In 539 of the 1,105 repos Apiiro traced, a Claude-coauthored commit changed the settings file. Half of the secret-bearing files had been on the default branch for at least 217 days. 🔹What The Count Includes, And What It Does Not🔹 Inside current copies: more than a third of secrets open a database, including 379 database passwords. Also 43 SSH logins for public servers. The broader 2,539 adds older versions (734 secrets in 509 repos no longer in the live file), shared .claude/settings.json, and agent transcripts. Apiiro did not attempt the credentials. One notified company confirmed its exposed key had been live. Exposure risk is proven. A live breach is not claimed here. Of 16 coding agents compared by documentation, Claude Code was the only one confirmed to write the full approved command into a project file by default. Over the 1,122 secret files, TruffleHog flagged 643 and gitleaks 564. Neither caught 215. Most misses are passwords inside commands. Scanners hunt key formats. 🔹Actionable Advices🔹 ▫️ Rotate before you clean 📝 Change every password, token and key that file ever held. Deleting the current copy does not erase history, forks or clones. ▫️ Put the ignore in the repo 📝 git rm --cached .claude/settings.local.json, then add it to the project's .gitignore. ▫️ Approve patterns, not secrets 📝 Prefer Bash(npm run:*) style rules. Keep credentials as variables from a secrets manager, not literals in the command Claude stores. ▫️ Treat agent folders like .env 📝 .claude/, .cursor/ and .gemini/ belong in secret scanning, including history, on laptops as well as remotes. The approval was meant to save time. The file saved the password. Convenience compounds. So does a credential that never should have been a config line. When you tap "don't ask again" on an AI coding agent, what exactly is it remembering for next time?