Apiiro: Claude Code "don't ask again" rules leak up to 2,539 secrets from public GitHub settings files

Linha do tempo

1. securityonline.info ↗ · pub. 08/11/2026 12:21 · coletado 08/11 12:53

   Apiiro finds 2,539 live secrets exposed in 1,994 public GitHub repos via Claude Code settings.local.json allowlists

   ler a análise desta fonte ocultar

   Researchers at Apiiro reported that Claude Code's permission allowlist mechanism has leaked credentials into 1,994 public GitHub repositories. When a developer picks "Yes, and don't ask again" for a proposed shell command, the agent stores the literal command string — including any inline password or token — as an allow rule in .claude/settings.local.json inside the project folder. Scanning 104,185 public copies of the file between 1 and 3 November 2026, Shmulik Cohen and Matan Giladi found 1,379 distinct secrets on default branches across 1,122 active files, rising to 2,539 real secrets once git history, shared settings files and agent chat transcripts were included. Apiiro published the study on 5 November 2026 (pasqualepillitteri.it, dev.to) and notified the 63 affected organisations on 2 and 3 November; at least one confirmed its exposed key was live. The behaviour in Anthropic's coding tool remains unchanged up to Opus 5.5 and no vendor advisory or public Anthropic statement on the issue was found at the time of writing.

   Technical Details

   The exposed material includes 398 service API tokens, 379 database passwords, 149 AI model API keys, 122 Supabase service-role keys, 110 Google API keys, 103 Supabase account tokens and 43 SSH logins; among the worst cases were a database vendor's admin-level cloud key, a Square production token and the owner password of a medical-records database. Claude Code adds the file to git's global exclude list the first time it writes it in a repository, but that rule never reaches the project's own .gitignore, so the protection fails when a folder becomes a repository later or is cloned to another machine (pasqualepillitteri.it). Commits co-authored by Claude modified the secret-bearing file in 539 of the 1,105 traced repositories. Conventional secret scanners are weak against this pattern: gitleaks and TruffleHog missed 215 of the 1,122 exposed files, because they key on structured provider prefixes rather than plain passwords typed inside PGPASSWORD, sshpass or curl headers. Exposed configuration files were also observed on Hugging Face Spaces and GitLab. The researchers did not test any credential or contact any host, defining a real secret as one matching a known provider format or a password paired with a public host, after filtering placeholders and expired tokens. Users had reported the mechanism in GitHub issues since August 2025 (#5544, #11982, #13106, #91270) without a reply.

   Remediation

   Search repositories and developer machines for .claude/settings.local.json and .claude/settings.json; where a secret is found, rotate it first and clean up afterwards, since deleting the file leaves the value in git history, clones and the 211 public forks identified. Untrack the file with git rm --cached, add agent configuration folders to the repository .gitignore template, reference credentials through environment variables such as $DB_URL instead of inline passwords, and extend pre-commit scanners to catch inline command passwords as well as standard provider tokens.

2. gbhackers.com ↗ · pub. 07/11/2026 05:31 · coletado 07/11 06:00

   Apiiro finds 2,539 secrets exposed in 1,994 public GitHub repos via Claude Code "Don't Ask Again" settings files

   ler a análise desta fonte ocultar

   Application-security vendor Apiiro published research on 5 November 2026 showing that Claude Code's "Yes, and don't ask again" approval option can persist a full shell command — credentials included — as an allowlist rule in .claude/settings.local.json, which developers then commit to public repositories. Apiiro counted 2,539 distinct secrets across 1,994 public GitHub repositories, including production database passwords, cloud credentials, API tokens and SSH logins, affecting 63 organizations; one notified organization confirmed its exposed key was live. The research was authored by Apiiro's Shmulik Cohen and Matan Giladi (itwire.com), who say they reproduced the behaviour with the latest models, Opus 5.5 and Fable 5.1, and that of 16 coding agents whose documentation they compared, Claude Code is the only one confirmed to save the full approved command in a project file by default (thehackernews.com). This is a configuration and developer-hygiene exposure rather than a product vulnerability: no CVE has been assigned and Anthropic has published no advisory on the matter; Apiiro did not test the credentials, so its "real secret" classification indicates credible material, not verified validity. The operational risk is nonetheless real, as infostealers and supply-chain worms already scan developer workstations for credentials and for Claude Code authentication artifacts.

   Technical Details

   The leak starts when Claude Code proposes a command containing credentials pulled from configuration files or supplied during troubleshooting. Choosing persistent approval stores the literal command as an allow rule instead of stripping its sensitive arguments. Claude Code adds the file to the developer's global git excludes the first time it writes it in a repository, per its settings documentation, but that protection lives in one user's git configuration on one machine, does nothing for an already-committed file and is never written to the project's own .gitignore (thehackernews.com). In 539 of 1,105 traced repositories, a commit listing Claude as co-author changed the file, suggesting the agent frequently commits it itself (thehackernews.com).

   Across 104,185 public copies of .claude/settings.local.json in 103,617 repositories, Apiiro found 1,122 files holding 1,379 distinct secrets — 636 provider-format keys and 743 passwords or tokens tied to public hosts. Database access dominated: 379 database passwords, 122 Supabase service-role keys and 103 Supabase account tokens, plus 43 SSH credentials (including root logins embedded in sshpass commands), 23 AWS keys and six private keys. Historical versions of deleted files contain 734 further secrets across 509 repositories, 211 forks of 74 repositories replicate the credentials, and 298 of 76,011 shared .claude/settings.json files also carry secrets (thehackernews.com). As of 2 November, every secret-bearing file was still on its repository's default branch, present for at least 217 days in half of them (thehackernews.com). Detection tooling was unreliable: Gitleaks flagged 564 secret-bearing files and TruffleHog 643, while neither flagged 215 — passwords following PGPASSWORD=, sshpass -p or mysql -p lack recognizable provider prefixes.

   Remediation

   Search the organization for .claude/settings.local.json and .claude/settings.json, including in git history where the files were deleted. Rotate every credential the files have ever held before cleanup, since deletion does not undo historical and fork exposure. Untrack the local file (git rm --cached) and add it to the repository's own .gitignore, then purge rules containing secrets from local copies even when never committed. Replace literal secrets with secret-manager-backed environment-variable references (e.g. $DB_URL) and approve command patterns such as Bash(npm run:*) instead of exact commands (thehackernews.com). Add pre-commit and CI scanning able to detect passwords embedded inside command lines, and check npm package contents, Docker images and archives that may ship the file.

3. thehackernews.com ↗ · pub. 07/11/2026 03:44 · coletado 07/11 05:00 primeiro registro

   Apiiro: Claude Code "don't ask again" allow rules leak 1,379 secrets in 1,122 public .claude/settings.local.json files on GitHub

   ler a análise desta fonte ocultar

   Software security company Apiiro reported that 1,122 public copies of Claude Code's project settings file .claude/settings.local.json on GitHub contain at least one secret, totalling 1,379 distinct secrets. The exposure comes from the assistant's "Yes, and don't ask again" permission prompt: when the approved item is an exact shell command rather than a pattern, Anthropic's agent stores the command verbatim — including any password or token typed into it — in plain text. Apiiro found the file in 103,617 repositories (104,185 copies), with roughly 1.1% holding a secret; it did not verify whether the credentials still work, although one notified company confirmed its key was live. More than a third of the secrets grant direct database access (379 database passwords), alongside 43 SSH logins to public servers, 42 GitHub/GitLab/npm tokens and 23 AWS keys, affecting 63 organisations, mostly software companies. No exploitation of these specific secrets is reported, which keeps operational urgency below critical, but the long exposure window — half the affected repositories had the file on their default branch for at least 217 days — makes credential compromise plausible.

   Technical Details

   By default Claude Code prompts before running most shell commands; choosing "Yes, and don't ask again" writes an allow rule into .claude/settings.local.json in the project, per its permissions documentation. The rule covers only what the prompt offered: sometimes a pattern such as npm test *, sometimes a single exact command, in which case embedded credentials are persisted in cleartext. The researchers reproduced the behaviour with the latest models, Opus 5.5 and Fable 5.1. On first write inside a git repository the tool adds the file to the user's global git excludes, a protection that is machine-local, does not travel with the project (it is never added to the repository .gitignore) and does nothing for already-committed files. In 539 of 1,105 traced repositories a commit listing Claude as co-author modified the file, suggesting the agent frequently commits it itself. Deleted copies still expose 734 further secrets across 509 repositories via git history, and 211 forks of 74 repositories replicate the originals' secrets; 298 of 76,011 copies of the deliberately shared .claude/settings.json also contain secrets, bringing the total to 2,539 secrets across 1,994 repositories. Common scanners miss much of this: run without verification, gitleaks flagged 564 and TruffleHog 643 of the 1,122 files, and neither flagged 215, because passwords after PGPASSWORD=, sshpass -p or mysql -p do not match known key formats. Of 16 coding agents whose documentation was compared, Claude Code is the only one confirmed to save the full approved command in a project file by default. The researchers note the exposure is not limited to GitHub: the plain JSON file can also ship inside an npm package, a Docker image, a zip archive or a synced folder, and credential-stealing malware already targets developer machines — in September 2025 the Shai-Hulud worm ran TruffleHog on infected hosts.

   Remediation

   Apiiro recommends rotating every password, token and key the files have ever held before cleanup, since deletion does not undo exposure in history or forks. Search the organisation for .claude/settings.local.json and .claude/settings.json, including git history where the files are gone; stop tracking the local file with git rm --cached .claude/settings.local.json and add it to the repository's own .gitignore and to organisational .gitignore templates. Open the file on local machines and delete rules containing secrets. Keep secrets out of commands by referencing variables from a secrets manager (e.g. $DB_URL), and approve patterns such as Bash(npm run:*) rather than exact commands. Security teams should treat agent folders (.claude/, .cursor/, .gemini/, .specstory/) and agent memory files like .env files, add them to pre-commit and CI secret scanning with detection for passwords inside command lines, and triage first the credentials paired with a public server address. A bug report filed on 11 August 2025 described the same verbatim storage of API keys; it was closed as "not planned" by an automated bot on 3 January after 60 days of inactivity, and the four related reports cited by the researchers have all been closed by the same bot without a reply from Anthropic.