Claude Code Convenience Button Left 1,379 Secrets in Public GitHub Repos, Apiiro Says

Approval fatigue is real, and Anthropic gave Claude Code users a cure for it. Click "Yes, and don't ask again" and the agent stops nagging. According to new research from security firm Apiiro, that same button has also been quietly writing database passwords, SSH logins and cloud keys into a plain text file that more than a thousand developers then pushed to public GitHub.

The mechanism is boringly simple, which is what makes it bad. Claude Code asks before it runs most shell commands. Pick the "don't ask again" option and it saves an allow rule into .claude/settings.local.json inside the project, so matching commands run without a prompt next time. Sometimes that rule is a pattern, such as npm test *. Sometimes it is the exact command the developer approved. In that second case, The Hacker News reports, any password or token typed into the command gets saved too, word for word, in plain text.

Apiiro researchers Shmulik Cohen and Matan Giladi say they reproduced it with Opus 5.5 and Fable 5.1, calling it a Claude Code problem, not a model one, iTnews reports.

The numbers behind the button

In its research write-up, Apiiro says it found 104,185 public copies of the file across 103,617 GitHub repositories. About 1.1% of them, or 1,122 copies, held at least one secret, adding up to 1,379 distinct secrets. More than a third open a database directly, including 379 database passwords. The haul also included 43 SSH logins for public servers, 42 GitHub, GitLab and npm tokens, and 23 AWS keys.

Add old versions in git history, the shared .claude/settings.json and saved agent chat logs, and the tally climbs to 2,539 secrets across 1,994 repositories.

Some caution is warranted. Apiiro sells security products and did not test whether any credentials still work. But one company the researchers notified confirmed its key had been live, and the firm says 63 organizations were among the file owners, including a database vendor with an admin-level cloud key and a medical-records database whose owner password was exposed.

Claude Code does try to keep the file out of git. The first time it writes the file in a repository, it adds it to the user's global git excludes, The Hacker News reports, citing Anthropic's documentation. The researchers note that protection lives on one machine, never reaches the project's own .gitignore and does nothing for a file already committed. In 539 of 1,105 repositories they traced, a commit listing Claude as co-author changed the file, which they read as Claude often committing it itself.

Standard scanners are not much of a safety net here. Of the 1,122 files with a secret, gitleaks flagged 564 and TruffleHog 643, and 215 slipped past both. And leaked credentials on GitHub are exactly what attackers hunt, as Microsoft showed when it said an AI hacking agent went from a GitHub leak to Key Vault data in five minutes.

The only public Anthropic response cited in the reports so far came in a Hacker News thread. Boris Cherny, head of Claude Code, said the team is looking into it, according to iTnews.

"Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this." Boris Cherny, head of Claude Code at Anthropic

Cherny said the team would prototype ideas such as having auto mode catch these commands and adding basic secret scanning, though iTnews reports he conceded they might not fix the problem. When a commenter noted that auto mode could leak the same way, his reply was "Yeah good catch." He also argued the exposed copies were created manually and checked in.

That argument would land better if users had not been flagging this since an August 11, 2025 bug report. The Hacker News says the four related reports Apiiro cites were all closed by an automated bot, none with a reply from Anthropic. The researchers' advice is blunt: rotate every credential the file ever held first, because deleting it leaves the secrets in history and forks. Then untrack it, add it to .gitignore, and approve patterns, not exact commands.