Apiiro Finds 1,122 Public GitHub Repos Leaking Secrets via Claude Code's "Don't Ask Again" Setting

What Happened

Security vendor Apiiro reported that Claude Code, Anthropic's AI coding assistant, can save approved commands to a project settings file when a user selects "Yes, and don't ask again." The saved command is stored word-for-word, including any secret typed into it. According to Apiiro, this has resulted in passwords and API keys being committed to 1,122 public GitHub repositories, where anyone can read them.

Why It Matters

This is a secrets-exposure problem rooted in developer workflow rather than a flaw in the model. When a one-time "don't ask again" approval captures a command verbatim, any password, token, or API key in that command gets written to disk. If the settings file is committed, it can be pushed to a public remote. Any team using Claude Code with permissive auto-approval settings could be affected. The risk grows with how many developers use the "don't ask again" option in public or poorly scoped repositories.

What Defenders Should Do Now

• Audit repositories for Claude Code project settings files that may contain approved-command history. Treat any secrets found there as compromised and rotate them.
• Review and tighten auto-approval and "don't ask again" settings for AI coding assistants. Avoid approving commands that include credentials on the command line.
• Add secret-scanning coverage, both pre-commit and repo-wide, tuned to catch credentials in AI-assistant configuration or settings files, not just source code.
• Favor environment variables, vaults, or credential managers over inline secrets in any command a developer might approve for reuse.
• Hunt for exposed secrets tied to your organization using GitHub secret-scanning alerts and third-party exposure-monitoring services.

Developing Story

Details here are based on Apiiro's reporting as covered by The Hacker News. The scope, the specific settings file involved, and any vendor response may change. This item has no associated CVE. Read the original coverage at The Hacker News for further updates.