Incident · medium
Claude Code settings leak passwords and keys to public GitHub repositories
Tier A · Patch today – Before you go home
Who’s exposed: Developers committing .claude folders with inline secrets to GitHub
Tier A because: Core infrastructure or popular tool AND secrets exposed
Reach
Attack
Damage
Fix
Popular tool · Secrets exposed
What to do
- Search your repositories for .claude/settings.local.json and .claude/settings.json and check for committed secrets
- Rotate any password or API key found in committed Claude Code settings
- Add .claude/settings.local.json to .gitignore
- Pass secrets through environment files or a password manager CLI instead of inline in commands
The Brief
- Passwords and API keys typed into commands that users approved with “Yes, and don’t ask again” in Claude Code were saved verbatim to .claude/settings.local.json.
- Researchers at Apiiro found 1,122 public GitHub copies of these files containing exposed secrets, per The Hacker News.
- Anthropic says settings.local.json is meant to stay local and is gitignored when Claude creates it, and that the files in this case were created manually and checked in. Claude Code has not historically scrubbed secrets, and Anthropic says it is looking into prevention.
Why it matters
Any secret typed inline into an approved command can end up in a committed settings file, so pushing that repository to GitHub publishes the credential to anyone.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Judgment: Claude Code is an AI coding assistant developers use daily. |
| No | Core infrastructure | Judgment: a single AI coding product, not software nearly every team runs. |
| Yes | Popular tool | Judgment: Claude Code is a mainstream developer tool used by many teams. |
| No | Exploited in the wild | The Hacker News: 1,122 public copies with exposed secrets; no attacker use reported. |
| No | Public exploit | Sources describe saved commands leaking; no exploit code or PoC is mentioned. |
| No | Remote, no login | The Hacker News: leak requires the user to select 'Yes, and don't ask again.' |
| No | Full takeover | The Hacker News: the issue exposes passwords and keys; no code execution or takeover reported. |
| Yes | Secrets exposed | The Hacker News: passwords and API keys sit in public GitHub repositories, readable by anyone. |
| No | Supply chain | Sources describe saved approval commands leaking secrets; no malicious code shipped. |
| No | No fix yet | No source states whether Anthropic has shipped a fix; not stated, so no. |
Timeline
Bug report about the issue filed with Anthropic, later closed automatically (per a Hacker News commenter)
Research on 1,122 public GitHub copies of exposed secrets published (The Hacker News, Apiiro)
The Hacker News
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Hacker News: Front Page
Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files
Hacker News
543 points · 375 comments
DEV Community: ai
Claude Code's "Don't Ask Again" Leaked Developers' Secrets to Public GitHub — Explained Honestly
DEV Community: ai
Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files
AI - Ars Technica
Claude Code is accidentally exposing secrets all over GitHub
Full coverage · 5 sources
- 4h ago ↗
AI - Ars Technica
Claude Code is accidentally exposing secrets all over GitHub - 1d ago ↗
- 1d ago ↗
DEV Community: ai
Claude Code's "Don't Ask Again" Leaked Developers' Secrets to Public GitHub — Explained Honestly - 2d ago ↗
Hacker News: Front Page
Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files - 3d ago ↗
The Hacker News
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
What developers are saying
Based on 375 comments · Mixed reactions
Commenters largely agree that inline secrets in approved commands should not end up in repositories, but disagree about who is responsible. Many blame users for committing local settings files and recommend secret managers, pre-commit scanners, or auto mode. Others argue the “Don’t Ask Again” behaviour is a design flaw, that the headline is misleading, and that Anthropic had not historically scrubbed secrets.
- Users committed local settings35%
- Secrets belong in managers30%
- Design flaw in Claude Code20%
- Headline overstates the issue15%
In favour
- + The settings file is documented as local, so the leak comes from manual check-ins rather than Claude itself
- + Using a password manager CLI or env files keeps secrets out of Claude entirely
- + Pre-commit secret scanners such as gitleaks would catch these leaks
Concerns
- − Approved commands are saved word-for-word, so secrets are persisted without scrubbing
- − Anthropic has not historically done secret scrubbing
- − A bug report about the issue reportedly was closed automatically
“Search your GitHub organization for .claude/settings.local.json and .claude/settings.json. Each hit is a file anyone can read right now.”
“So pressing “Don’t Ask Again” by itself doesn’t expose passwords by itself.”
“.claude/settings.local.json is meant to stay local. This is not a file you should check into source control.”
First seen · 5 sources · 375 comments · Full story page · How tiers are decided