What does Claude Code's "Yes, and don't ask again" option save?

It saves a standing rule in .claude/settings.local.json inside your project folder. Apiiro says the rule is the command itself, so a password typed into the command is saved with it. Anthropic's documentation says a saved rule covers what the prompt option named, so it may be a pattern or one exact command.

How many secrets does Apiiro say it found on GitHub?

Apiiro says 1,122 of 104,185 public copies of the file held a real secret, 1,379 distinct secrets in all. Counting more places, it reports 2,539 distinct secrets in 1,994 repositories. A real secret here means a pattern match that an AI reviewer also accepted, not a password tested as working.

What did Anthropic's team reply, and is there a fix?

Apiiro says Anthropic's Head of Claude Code replied on Hacker News; we cannot check the account's role. The comment says the team is "looking into what we can do to prevent this" and will prototype options such as auto mode and basic secret scanning. It also says the file is gitignored when Claude creates it, so in this case copies were created manually and checked in, and calls permission rules "old hat" and auto mode "safer", which are the commenter's claims, untested by us. Apiiro's page describes no shipped fix, and we found none in the changelog entries we read through November 9.

Did Apiiro test whether the secrets work?

No. Apiiro says no credential was used or tested and no host was contacted. It says one organization confirmed its key had been live, and gives no count of working secrets.

What should a team check this week?

From Apiiro: search your GitHub projects and their history for the file, change every password or key it ever held, stop tracking the file, and keep secrets out of commands. Have each developer check their own saved rules, even in projects never published.

Claude Code's 'Don't Ask Again': What Apiiro Counted

A brushed-metal filing cabinet with glass drawers full of file folders, one drawer pulled open with a small glowing red key tag hanging on a folder, and a thin red light trail running from it across a dark reflective floor to a glowing red cube.

The short version

If your developers use Claude Code, clicking "Yes, and don't ask again" can save the command, including any password typed in it, to a file (.claude/settings.local.json). Security company Apiiro says 1,122 of 104,185 public copies of that file held a real secret, untested. A commenter who says they are on the Claude Code team, as relayed by Apiiro, says prevention is being looked into; no fix is described.

In plain words

Claude Code is an AI coding assistant that runs commands on a developer's computer, and often asks permission first. Click "Yes, and don't ask again" and it can save that command in a small file in the project folder, like a sticky note saying "always allowed". If the command had a password in it, the note holds the password.

Publish the project on GitHub, a public site where developers share code, and the note can go public too. Security company Apiiro counted such files and says some held what it calls real secrets, untested. Below: what its numbers cover, what a commenter who says they are on the Claude Code team replied, and what to do this week.

Apiiro, a security company that sells security for agentic software development, went looking on GitHub for such files. Its count is a vendor's own measurement; we read it and did not reproduce it. A secret here means a password, key or token that proves to a service who is calling.

How many saved passwords and keys did Apiiro count?

Apiiro searched public GitHub from November 1 to 3, 2026 and found 104,185 public copies of the file. In 1,122 of them it found what it calls a real secret. That is about 1 in 93 files (our arithmetic; Apiiro gives 1.1%). Together those files held 1,379 distinct secrets, such as database passwords, cloud keys and server logins.

Careful with the word "real". It does not mean the password works. Apiiro defines it: "'Real secret' means a credential that matches a provider format or points at a public host, not one known to be valid." Pattern rules found candidates, an AI reviewer checked them, and a value counted only if both agreed. Apiiro says: "No credential was used or tested, and no host was contacted." It adds that one organization confirmed its key had been live, without naming it or saying how many others work.

Apiiro also ran two secret scanners, gitleaks and TruffleHog, over all 104,185 files. Of the 1,122 files with a real secret, they flagged 564 and 643, and 215 slipped past both. The two lists overlap, so 564 and 643 add up to more than the 907 files that at least one caught (our arithmetic). Apiiro says the misses are mostly passwords typed inside commands, which look like ordinary words, not key formats.

Counting more places, Apiiro reports 2,539 distinct real secrets in 1,994 repositories. A repository (repo) is a project folder that git, the program that tracks a project's files, keeps. The extra places are older versions of the file, a second settings file that teams share on purpose, and saved chat transcripts. Apiiro says most belong to individual developers. Do not add this count to the first one; it covers more places. Within the research, Apiiro says 63 organizations hold a real secret in a public allowlist (the saved list of approved commands).

Why would a file meant to stay private end up public?

The file is meant to stay on one computer. Anthropic's settings page says Claude Code "keeps it out of git when it creates the file". It does this by adding the file to a "global git excludes file", a do-not-track list kept on that one machine. Apiiro's point: the project's own list (its .gitignore) never gets the entry, so the protection stays with that machine. By Apiiro's account it does not cover a copy of the project made on another computer, a folder that becomes a git project later, or a file already committed.

Anthropic's permissions page describes the same saving: choose "Yes, and don't ask again" and the rule goes to that file. It also says a saved rule "covers only what its option named". So it may be a pattern of commands or one exact command.

Deleting the file later does not undo it. A project keeps a history of every earlier saved version, and so do copies of the project made by others. That is why Apiiro says to change the password first and clean up second. Of 1,105 repositories with a real secret that Apiiro traced, 539 had a saved change to the file that listed Claude as a co-author. Apiiro writes: "Often Claude commits the file itself." In our reading, a co-author line shows that Claude was credited on a change, not who typed the password.

What did a Claude Code team member say?

Apiiro's November 8 update says Anthropic's Head of Claude Code replied on Hacker News, a popular tech discussion site, on November 7. We read the thread. The author of the comment says they are on the Claude Code team; we cannot check the account's role, so read it as a forum comment, not a company statement.

The comment says: "Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this." Secret scrubbing means finding and removing secrets before they are saved. A later comment lists ideas, "making sure auto mode catches this, building in basic secret scanning", and says the team is "Going to prototype a few of these to understand the tradeoffs better before we ship something." Auto mode is a setting where, per Claude Code's documentation, a second AI model reviews actions instead of the person. The first comment also says permission rules are "old hat", that everyone should use auto mode instead, and that auto mode is "safer" and "enabled by default". Those are the commenter's claims; we tested nothing. Apiiro's advice below puts the emphasis the other way: tighten the rules. That first comment also suggests switching on the secret scanning that GitHub and other hosts offer, which warns you when a known key format is uploaded.

On how the public files got there, the two sides differ. The reply says: "We automatically gitignore it when Claude creates the file, so in this case the files were manually created and checked in". Apiiro counts the 539 repositories above. In our reading both can be true at once, and we do not decide between them.

Has it been fixed?

Not that we can find. Apiiro's page describes only the prototype plans above. We searched Anthropic's Claude Code changelog on November 9, and the entries we read through November 9 mention no change to how approved commands are saved. The latest entry, 2.1.319, is dated November 6, a day before the reply, so the changelog could not yet show a response.

What should you ask your engineers this week?

These steps follow Apiiro's recommendations, plus a detail on patterns from Anthropic's permissions page.

Do this week

Five steps for you and your engineering lead; no new software needed.

Ask whether any of your GitHub projects are public, and whether any contains a folder named .claude. Ask them to check the project history too, not only today's files.
If a password or key turns up, have someone change it at the service that issued it before anything else. Deleting the file does not fix it, because old versions live on in history and in copies.
Ask your engineers to stop git from tracking the file and to add it to the project's own do-not-track list. For your developer: git rm --cached .claude/settings.local.json, then add the file to the repository's .gitignore.
Going forward, ask that passwords be referred to by name (a variable) instead of typed into commands, and that approvals cover narrow command patterns (such as 'git log *', not 'git *', which allows every git command) rather than exact commands.
Ask each developer to open .claude/settings.local.json in their projects, even ones never published, delete every saved rule that holds a password and change that password.

Book an AI discovery call

What we checked and what we could not

We read these public pages on November 9, 2026: Apiiro's post (printed date November 5, updated November 8), the Hacker News thread, Anthropic's Claude Code settings, permissions, permission-modes and changelog pages, and a November 7 report by the security news site The Hacker News (not the forum) for context only. The original post is older than this week; the update with the reply is within it. We tested nothing, and every number is Apiiro's. A developing story: a snapshot of November 9.

The pages we read do not say how many of the secrets work, how many of the 1,122 files the tool created itself (Apiiro's nearest figure is the 539 repositories above), or when a fix might ship. They mention no outside check of Apiiro's count. Apiiro compared how 16 coding agents store approvals, from their documentation, and says Claude Code is the only one confirmed to write the full approved command to a project file by default. It gives no secret counts for the others, and we did not check those 15 agents' documentation. Apiiro's headline counts are from public GitHub (it also looked at Hugging Face Spaces and GitLab.com in small samples); it says most such files stay on laptops, uncounted. Apiiro cites GitHub issues; we opened one: #5544, filed August 11, 2025 about credentials stored in plain text in this file, was closed by a bot on January 3, 2026 for inactivity; the issue page shows no reply from Anthropic.

Apiiro's number	What it counts	Keep in mind
104,185	Public copies (files) of .claude/settings.local.json	In 103,617 repositories on GitHub
1,122	Files among them holding a real secret	Files, not secrets. Apiiro gives 1.1%
1,379	Distinct secrets inside those 1,122 files	636 in a known key format, 743 passwords or tokens next to a public host
539 of 1,105	Traced repositories with a real secret where a saved change to the file was co-authored by Claude	Repositories, not files
2,539 / 1,994	Distinct real secrets / repositories holding them	Also counts the file's history, the shared settings file and chat transcripts
63	Organizations	Those holding a real secret in a public allowlist (a saved list of approved commands)

Apiiro Says Claude Code's Don't Ask Again Option Can Save Passwords: What It Counted on GitHub