Sunday, November 8, 2026
IT BusinessDigest
Get the Daily Brief
News

Claude Code's 'don't ask again' left 1,379 secrets on GitHub: the fix

Approve a command once with a password in it and Claude Code can save the password to a project file. One managed setting stops it saving any new rules. Where that setting goes on each OS, and the order to search, rotate and clean up.

Avery Lane AI and software writer · · 4 min read
black and gray laptop displaying codes

When a developer approves a shell command in Claude Code and picks "Yes, and don't ask again", the tool stores that command as a permission rule in .claude/settings.local.json inside the project. If the command had a database password or an API token typed into it, the password is now in the file. Application security firm Apiiro searched public GitHub between November 1 and 3 and found 104,185 copies of that file in 103,617 repositories. In 1,122 of them, about 1.1%, it found a real secret: 1,379 distinct ones, among them 379 database passwords, 122 Supabase service-role keys, 43 SSH logins, 23 AWS keys, and 42 tokens for GitHub, GitLab or npm.

Why it matters to IT teams

Apiiro counts 63 affected organizations. Its examples include a production Azure Postgres password and a Square production token, and one company confirmed to Apiiro that its exposed key had been live. Apiiro did not try any of the credentials. Counting older versions, the shared .claude/settings.json and saved agent transcripts, its total is 2,539 secrets in 1,994 repositories. Of the 16 coding agents whose documentation it compared, Claude Code was the only one confirmed to save full approved commands into a project file out of the box.

The two sides disagree on how the files got out. Claude Code's documentation says the tool lists the local file in the developer's global git excludes when it first creates it, and that anyone who creates the file by hand must add it to .gitignore themselves. In a Hacker News reply, Boris Cherny, who Apiiro says leads Claude Code, said the public files "were manually created and checked in". Apiiro says the global exclude does not follow a clone onto another machine or protect a directory turned into a repository afterwards, and that in 539 of the 1,105 repositories it traced, nearly half, Claude was a co-author on a commit that changed the file. Cherny said Claude Code has not done secret scrubbing so far and that the team will prototype fixes, including basic secret scanning. He gave no date.

Default scanners will not find all of it. Apiiro ran gitleaks and TruffleHog over every file: gitleaks flagged 564 of the 1,122, TruffleHog 643, and 215, about one in five, were caught by neither. Most of the misses are passwords sitting inside ordinary commands, after PGPASSWORD=, sshpass -p or mysql -p, where there is no key prefix to match.

The admin setting that stops new rules being saved

Claude Code has a managed-only key, allowManagedPermissionRulesOnly. Set to true, it makes managed settings the only source of permission rules. According to Anthropic's settings reference, rules from user, project and local files are ignored, the always-allow choices disappear from prompts, and Claude Code "stops saving new rules".

The key only works in managed settings, which reach machines three ways: server-managed settings from the claude.ai console, an MDM policy, or a managed-settings.json file placed by your own tooling at:

  • Windows machines: C:\Program Files\ClaudeCode\managed-settings.json
  • Macs: /Library/Application Support/ClaudeCode/managed-settings.json
  • Linux, including WSL: /etc/claude-code/managed-settings.json

The cost is that every pre-approved command must now be listed in managed settings. Cherny's own advice is to use auto mode, which he says is on by default, and drop allow lists.

What IT teams should do

  • Run a code search across your GitHub organization for both files, .claude/settings.local.json and the shared .claude/settings.json, then check each repository's history for both. Apiiro found 734 secrets in 509 repositories that survive only in older versions of the file, and 211 forks of 74 repositories carrying the same ones.
  • Rotate every credential the files have ever held before you delete anything. Removing the file does not clear history, forks or clones.
  • Stop tracking the local file (git rm --cached .claude/settings.local.json), then list it in every repository's own .gitignore and in your organization's templates.
  • On laptops, open the file in each project and delete any rule with a secret in it.
  • Deploy allowManagedPermissionRulesOnly through managed settings, or at least require patterns such as Bash(npm run:*) and secrets passed as $VAR from a secrets manager.
  • Add .claude/, .cursor/, .gemini/ and .specstory/ to pre-commit and CI secret scanning, with a rule for passwords inside commands.

Related: how Goldman limited Claude Code and Copilot to engineers, the Cursor and Claude Code extension backdoor check and the Northflank key rotation list.

Sources: Apiiro research, Hacker News thread, Claude Code settings docs, allowManagedPermissionRulesOnly reference, Deploy managed settings, Configure permissions, Let's Data Science.

Sources