Claude Code: your "don't ask again" is a password in plain text

You know the moment. Claude Code asks permission to run a command. You hit "Yes, and don't ask again," because you're not approving the same thing for the twentieth time.

That click is the problem.

What Apiiro found

According to research by security firm Apiiro, reported by The Hacker News on November 7, Claude Code stores the full approved command as a rule in a project file when you pick "don't ask again," usually .claude/settings.local.json. If the command contained a password or token, it now sits there in plain text.

• Apiiro found the file in more than 104,000 public GitHub repositories.
• 1,122 of them contain at least one secret, 1,379 distinct ones in total, including 379 database passwords, 43 SSH logins and 23 AWS keys.
• 63 organizations are affected, mostly software companies. Counting old versions and agent logs, Apiiro tallies 2,539 secrets across 1,994 repositories.

Apiiro didn't test whether the credentials still work. One notified company confirmed a live key. The report includes no statement from Anthropic; the researchers say earlier bug reports about the same behavior were closed by a bot.

This isn't a bug. It's approval fatigue

Here's what I find interesting: the hole isn't in the model, it's in the workflow. Agents ask a lot, humans eventually click blind. Every convenience rule becomes an archive of what you approved. Password included.

And this is no longer a developer-only problem. Marketing teams build landing pages, reports and automations with Claude Code. I build my own site and funnel this way. Which means the people holding the keys to the CRM, the newsletter tool and the ad account now live in the terminal. Often without a security team anywhere near them.

Per Apiiro, in 539 of the repositories it traced, Claude itself is listed as co-author on the commit that changed the file. The agent doesn't just tidy up. It commits.

The catch: git isn't the only place

Claude Code excludes the local file from git on your machine only, not in the project. And Apiiro points out the file can also end up in archives, Docker images or synced folders.

Synced folders. My project lives in Dropbox. I checked the file this morning (Nov 8, 2026): six rules, no password, no token. Lucky. Not a strategy.

What I'd do now

• Search today. Look for .claude/settings.local.json and .claude/settings.json in every repo and shared folder, git history included.
• Rotate first, clean up second. Any key that ever sat in one of these files gets reissued. Deleting the file isn't enough.
• Get secrets out of commands. Load credentials as variables from a password manager, approve patterns (like npm run:*) instead of single commands, and add the file to .gitignore.

Bottom line: Every "don't ask again" is a decision you'll never see again. Treat it like a password.