"Yes, and Don't Ask Again" Is How Your Database Password Ended Up on GitHub

Every AI coding agent asks you for permission to run commands. And every developer, around the fortieth prompt, clicks the option that makes it stop asking. New research says that click has been quietly publishing passwords.

What Was Reported

Per Cybersecurity News, reporting on research from Apiiro:

• In Claude Code, picking "Yes, and don't ask again" on a shell command saves that command as an allow rule in .claude/settings.local.json. If the command had a secret in it (a password on a psql line, a token in a curl header), the secret gets saved too, in plaintext.
• That file is meant to stay local. Claude Code adds a global gitignore entry when it first writes the file, but the researchers say that doesn't travel with the project, doesn't help if the file is already tracked, and doesn't reliably cover repos created later.
• Apiiro looked at 104,185 public copies of that file on GitHub. It found real secrets in 1,122 of them. Counting earlier commits, shared settings and agent transcripts, the total was 2,539 distinct secrets across 1,994 public repos, including hundreds of database passwords, Supabase service-role keys and SSH logins.
• The kicker for anyone who thinks their scanner has this covered: of the 1,122 files, 215 weren't flagged by Gitleaks or TruffleHog. A password typed inline in a command doesn't look like a known key format.

I couldn't read Apiiro's original post, so these numbers are as reported. The article didn't include a response from Anthropic or say whether a product change is coming.

My Take

This isn't really a Claude Code bug, and it isn't unique to Claude Code. It's what happens when a convenience feature meets a file that lives inside the repo. The approval list is a log of exactly the commands you ran most, which are exactly the ones with your credentials in them.

AI agents are making this pattern more common, not less. They create config, memory and transcript files all over the project directory, and most teams have no idea what's in them. That's a new place for secrets to hide, and old scanners are tuned for the old places.

The deeper fix is the one we've been preaching for years: secrets shouldn't be typed into commands at all. If the agent pulls the database password from a secrets manager, there's nothing for "don't ask again" to save.

What To Do

• Search your repos and their history for .claude/settings.local.json, and review the shared .claude/settings.json too.
• If you find a secret, rotate it first. Deleting the file or rewriting history doesn't help if someone already copied it.
• Untrack it and ignore it in the project: git rm --cached .claude/settings.local.json, then add the path to the repo's own .gitignore.
• Read your allow rules. Anything with a password, token, connection string or auth header gets removed.
• Keep secrets out of command lines. Reference a secrets manager or environment variable instead of pasting the value.
• Scan agent folders, memory files and transcripts with rules that catch inline passwords, not just known key formats.
• This goes for every coding agent your developers use, not just this one.

Bottom Line

"Don't ask again" means "remember this forever, in a file." Make sure that file never leaves the laptop, and better yet, make sure there's nothing secret in it to begin with.

Source: Cybersecurity News, reporting on research from Apiiro