syslog.eu
CS EN DE FR
[WARNING · CHECK THIS WEEK]/News·

Claude Code's "don't ask again" writes secrets into a file that gets committed – check your repos

Security firm Apiiro reported on November 7 that Claude Code stores every command a user approves with "Yes, and don't ask again" – secret included, even one taken from a config file – in .claude/settings.local.json, a file that regularly ends up in Git. Across this file, its history and other agent files, Apiiro counted 2,539 real secrets in 1,994 public GitHub repositories.

Affected claude-code git github
Syslog card, level WARNING (check this week): 1,122 files with secrets, public Claude Code settings on GitHub. Affected: Claude Code, GitHub, Git. To do: Find every .claude/settings.local.json; Rotate every secret the file ever held.

Does this concern you?

  • Affected: companies where a developer, an outside IT provider or a colleague trying out AI uses Claude Code on projects that touch databases, cloud accounts or servers. A file that never reaches Git still sits on laptops as plain JSON.
  • Skip it if: nobody in the company uses Claude Code. Of 16 coding agents Apiiro compared from their documentation, only Claude Code is confirmed to do this by default; Apiiro still advises treating .cursor/, .gemini/ and .specstory/ folders like .env.

What to do

  • Search your GitHub organisation for .claude/settings.local.json and .claude/settings.json, including each repository's history: a deleted file still lives in old commits, forks and clones.
  • Rotate every secret the file has ever held first, clean up second. In our view, also check each service's logs back to the file's first commit.
  • If the file is tracked, run git rm --cached .claude/settings.local.json and add it to the repository's own .gitignore.
  • On laptops, open the file, even if never committed, and delete every rule containing a secret.
  • Ask an outside IT provider in writing whether they have checked this file.
  • Ask Claude Code users to reference secrets as variables ($DB_URL) instead of typing them, and to approve patterns such as Bash(npm run:*) rather than literal commands.
  • If CI scans for secrets, include history and passwords inside commands (PGPASSWORD=, sshpass -p): neither gitleaks nor TruffleHog flagged 215 of the 1,122 files with a real secret.

What we know – and what we don't

  • 1,122 of the 104,185 public copies of the file on GitHub hold a real secret.
  • Claude Code adds the file to the developer's global Git ignore list, which Apiiro says covers the common case, but not to the repository's .gitignore: a folder that becomes a repository later or a clone on another machine is unprotected.
  • "Real secret" means a key in a known format or a password next to a public host; Apiiro tested none. Of the 63 organisations it notified on November 2 and 3, one confirmed its key had been live.
  • Apiiro says Anthropic answered none of the GitHub reports users filed since August 2025. We have seen no statement or fix from Anthropic.

Why it matters

Few people review a settings file they never wrote. In our view, an agent's settings deserve the same care as an .env file, in the repository and on the laptop.

Sources

← All news