EN PT-BR
← Voltar ao feed
high technology healthcare

Apiiro: Claude Code "don't ask again" allow rules leak 1,379 secrets in 1,122 public .claude/settings.local.json files on GitHub

1 fonte(s) · 1 atualização(ões) · publicado 07/11/2026 03:44 · coletado há 1 hora

Software security company Apiiro reported that 1,122 public copies of Claude Code's project settings file .claude/settings.local.json on GitHub contain at least one secret, totalling 1,379 distinct secrets. The exposure comes from the assistant's "Yes, and don't ask again" permission prompt: when the approved item is an exact shell command rather than a pattern, Anthropic's agent stores the command verbatim — including any password or token typed into it — in plain text. Apiiro found the file in 103,617 repositories (104,185 copies), with roughly 1.1% holding a secret; it did not verify whether the credentials still work, although one notified company confirmed its key was live. More than a third of the secrets grant direct database access (379 database passwords), alongside 43 SSH logins to public servers, 42 GitHub/GitLab/npm tokens and 23 AWS keys, affecting 63 organisations, mostly software companies. No exploitation of these specific secrets is reported, which keeps operational urgency below critical, but the long exposure window — half the affected repositories had the file on their default branch for at least 217 days — makes credential compromise plausible.

Detalhes técnicos

By default Claude Code prompts before running most shell commands; choosing "Yes, and don't ask again" writes an allow rule into .claude/settings.local.json in the project, per its permissions documentation. The rule covers only what the prompt offered: sometimes a pattern such as npm test *, sometimes a single exact command, in which case embedded credentials are persisted in cleartext. The researchers reproduced the behaviour with the latest models, Opus 5.5 and Fable 5.1. On first write inside a git repository the tool adds the file to the user's global git excludes, a protection that is machine-local, does not travel with the project (it is never added to the repository .gitignore) and does nothing for already-committed files. In 539 of 1,105 traced repositories a commit listing Claude as co-author modified the file, suggesting the agent frequently commits it itself. Deleted copies still expose 734 further secrets across 509 repositories via git history, and 211 forks of 74 repositories replicate the originals' secrets; 298 of 76,011 copies of the deliberately shared .claude/settings.json also contain secrets, bringing the total to 2,539 secrets across 1,994 repositories. Common scanners miss much of this: run without verification, gitleaks flagged 564 and TruffleHog 643 of the 1,122 files, and neither flagged 215, because passwords after PGPASSWORD=, sshpass -p or mysql -p do not match known key formats. Of 16 coding agents whose documentation was compared, Claude Code is the only one confirmed to save the full approved command in a project file by default. The researchers note the exposure is not limited to GitHub: the plain JSON file can also ship inside an npm package, a Docker image, a zip archive or a synced folder, and credential-stealing malware already targets developer machines — in September 2025 the Shai-Hulud worm ran TruffleHog on infected hosts.

Remediação

Apiiro recommends rotating every password, token and key the files have ever held before cleanup, since deletion does not undo exposure in history or forks. Search the organisation for .claude/settings.local.json and .claude/settings.json, including git history where the files are gone; stop tracking the local file with git rm --cached .claude/settings.local.json and add it to the repository's own .gitignore and to organisational .gitignore templates. Open the file on local machines and delete rules containing secrets. Keep secrets out of commands by referencing variables from a secrets manager (e.g. $DB_URL), and approve patterns such as Bash(npm run:*) rather than exact commands. Security teams should treat agent folders (.claude/, .cursor/, .gemini/, .specstory/) and agent memory files like .env files, add them to pre-commit and CI secret scanning with detection for passwords inside command lines, and triage first the credentials paired with a public server address. A bug report filed on 11 August 2025 described the same verbatim storage of API keys; it was closed as "not planned" by an automated bot on 3 January after 60 days of inactivity, and the four related reports cited by the researchers have all been closed by the same bot without a reply from Anthropic.

Linha do tempo

  1. thehackernews.com ↗ · pub. 07/11/2026 03:44 · coletado 07/11 05:00 primeiro registro

    Apiiro: Claude Code "don't ask again" allow rules leak 1,379 secrets in 1,122 public .claude/settings.local.json files on GitHub

    ler a análise desta fonte

    Software security company Apiiro reported that 1,122 public copies of Claude Code's project settings file .claude/settings.local.json on GitHub contain at least one secret, totalling 1,379 distinct secrets. The exposure comes from the assistant's "Yes, and don't ask again" permission prompt: when the approved item is an exact shell command rather than a pattern, Anthropic's agent stores the command verbatim — including any password or token typed into it — in plain text. Apiiro found the file in 103,617 repositories (104,185 copies), with roughly 1.1% holding a secret; it did not verify whether the credentials still work, although one notified company confirmed its key was live. More than a third of the secrets grant direct database access (379 database passwords), alongside 43 SSH logins to public servers, 42 GitHub/GitLab/npm tokens and 23 AWS keys, affecting 63 organisations, mostly software companies. No exploitation of these specific secrets is reported, which keeps operational urgency below critical, but the long exposure window — half the affected repositories had the file on their default branch for at least 217 days — makes credential compromise plausible.

    Technical Details

    By default Claude Code prompts before running most shell commands; choosing "Yes, and don't ask again" writes an allow rule into .claude/settings.local.json in the project, per its permissions documentation. The rule covers only what the prompt offered: sometimes a pattern such as npm test *, sometimes a single exact command, in which case embedded credentials are persisted in cleartext. The researchers reproduced the behaviour with the latest models, Opus 5.5 and Fable 5.1. On first write inside a git repository the tool adds the file to the user's global git excludes, a protection that is machine-local, does not travel with the project (it is never added to the repository .gitignore) and does nothing for already-committed files. In 539 of 1,105 traced repositories a commit listing Claude as co-author modified the file, suggesting the agent frequently commits it itself. Deleted copies still expose 734 further secrets across 509 repositories via git history, and 211 forks of 74 repositories replicate the originals' secrets; 298 of 76,011 copies of the deliberately shared .claude/settings.json also contain secrets, bringing the total to 2,539 secrets across 1,994 repositories. Common scanners miss much of this: run without verification, gitleaks flagged 564 and TruffleHog 643 of the 1,122 files, and neither flagged 215, because passwords after PGPASSWORD=, sshpass -p or mysql -p do not match known key formats. Of 16 coding agents whose documentation was compared, Claude Code is the only one confirmed to save the full approved command in a project file by default. The researchers note the exposure is not limited to GitHub: the plain JSON file can also ship inside an npm package, a Docker image, a zip archive or a synced folder, and credential-stealing malware already targets developer machines — in September 2025 the Shai-Hulud worm ran TruffleHog on infected hosts.

    Remediation

    Apiiro recommends rotating every password, token and key the files have ever held before cleanup, since deletion does not undo exposure in history or forks. Search the organisation for .claude/settings.local.json and .claude/settings.json, including git history where the files are gone; stop tracking the local file with git rm --cached .claude/settings.local.json and add it to the repository's own .gitignore and to organisational .gitignore templates. Open the file on local machines and delete rules containing secrets. Keep secrets out of commands by referencing variables from a secrets manager (e.g. $DB_URL), and approve patterns such as Bash(npm run:*) rather than exact commands. Security teams should treat agent folders (.claude/, .cursor/, .gemini/, .specstory/) and agent memory files like .env files, add them to pre-commit and CI secret scanning with detection for passwords inside command lines, and triage first the credentials paired with a public server address. A bug report filed on 11 August 2025 described the same verbatim storage of API keys; it was closed as "not planned" by an automated bot on 3 January after 60 days of inactivity, and the four related reports cited by the researchers have all been closed by the same bot without a reply from Anthropic.