One "don't ask again," and the secret is on file
Security firm Apiiro published the research on November 5, written by Shmulik Cohen and Matan Giladi. When Claude Code is asked to check a database or call an API, the command it proposes often carries a secret from the local config; if the user picks "Yes, and don't ask again," that exact command is saved as an allow rule in .claude/settings.local.json in the project folder. Apiiro says this is the behavior of the Claude Code tool itself and that it reproduced it with Opus 5.5 and Fable 5.1. When Claude Code creates the file inside a repo, it adds it to the developer's global git ignore list, but not to the repo's own .gitignore, so a clone on another machine, a folder that becomes a repo later, or a file already committed is not covered.
How much is on public GitHub
Searching default branches on public GitHub from November 1 to 3, Apiiro found 104,185 copies of the file in 103,617 repositories. 1,122 of them (1.1%) hold a real secret, 1,379 distinct values in total, including 379 database passwords, 43 SSH logins and 23 AWS keys. In 539 of the 1,105 repos it traced, a commit co-authored by Claude changed the file. Counting git history, the shared settings.json that teams commit and agent chat transcripts, the total is 2,539 secrets in 1,994 repositories across 63 organizations, and one company confirmed its key had been live. gitleaks flagged only 564 of the files and TruffleHog 643; 215 were flagged by neither, because passwords after PGPASSWORD= or sshpass -p don't match common key formats. "Real secret" here means a credential that matches a provider format or points at a public host; Apiiro did not test whether each one works.
The response, and how to check
Boris Cherny, who leads Claude Code, replied on Hacker News on November 7 that Claude Code has not historically done secret scrubbing and that the team will prototype approaches such as having auto mode catch this and building in basic secret scanning. He also said the file is not meant to be committed and recommended using auto mode and enabling secret scanning on the code host. Apiiro recommends rotating every credential the file has held first, then untracking it with git rm --cached and adding it to the repo's .gitignore, referencing secrets as environment variables in commands, and approving command patterns rather than literal commands.
via: Apiiro: Coding Agents Copy Your Secrets to a Hidden File. Thousands Are on GitHub, Hacker News discussion (including Boris Cherny's replies)