Skip to content
NLEN
Illustration: a laptop with a code folder from which a small glowing red settings file lets golden keys escape towards a cloud of public repositories.

Claude Code saved approved commands with passwords in them: how to check your repository

By Ivo Donker · — text: Claude (AI, Anthropic), checked against the sources

If you choose "Yes, and don't ask again" for a shell command in Claude Code, Claude Code writes that command as a permanent rule into .claude/settings.local.json in your repository. If the command contained a password or API key, that key now sits in the file too. According to research by security firm Apiiro, as reported by trade media, 1,122 public copies of that file on GitHub held at least one secret. Check whether the file is in git, rotate leaked keys and add the file to .gitignore.

This article explains how it happens, what the figures are and what you can do today. More on the tool itself is in our Claude Code review; recent updates are collected in Claude Code news.

How a password ends up in a settings file

Anthropic's documentation describes the behaviour. For shell commands, a "don't ask again" approval applies "permanently per repository and command". Claude Code stores the rule in .claude/settings.local.json at the root of the git repository, and the rule then applies in every session in that repository, including subdirectories and worktrees.

The rule is the text of the command. Approving a database command with the password in it (PGPASSWORD=..., mysql -p... or sshpass -p ...) stores that password in plain text in the file. The file is meant to be personal. The leak happens once someone commits it anyway and the repository is public.

What Apiiro found

The figures come from Apiiro research that we could not open ourselves. We give them as a summary on DEV Community and GBHackers report them.

What Apiiro found
MeasureValue according to Apiiro (via trade media)
Public copies of .claude/settings.local.json examined104,185, in 103,617 repositories
Files with at least one secret1,122
Distinct secrets in those files1,379
Missed by both gitleaks and TruffleHog215 files
Total across all sources (including git history and chat logs)2,539 secrets in 1,994 repositories

According to the same summary, Claude Code was the only one of 16 compared coding agents that stores the full approved command in a project file by default. We could not verify that ourselves. We found no response from Anthropic to the research. The signal also appeared in the Radar of November 8 and in the November 9 briefing.

How to check your own repository

  1. Is the file in git? git ls-files .claude/settings.local.json shows whether it is tracked now; git log --all -- .claude/settings.local.json whether it was ever committed.
  2. Rotate first. A key that sat in a public repository counts as leaked, even if you rewrite history. Replace passwords and tokens before you clean up.
  3. Stop tracking. git rm --cached .claude/settings.local.json and add the path to .gitignore.
  4. Clean up the rules. /permissions in Claude Code shows the stored rules, and lets you delete rules that contain a secret.
  5. Prevent a repeat. Use variables instead of literal values (PGPASSWORD="$DB_PASSWORD") and block reading key files with a deny rule such as Read(./.env), which the documentation itself gives as an example.

Teams can add the file to their .gitignore templates by default and include folders such as .claude/, .cursor/ and .gemini/ in the secret scan of pre-commit and CI, git history included. More background on risks like this is in our overview AI and cybersecurity.

What we did not check

We could not open Apiiro's research page; all figures come from third-party summaries. We did read the "don't ask again" behaviour and the storage in .claude/settings.local.json in Anthropic's documentation.

Checked on November 9, 2026.

This article was written with AI (Claude, Anthropic) and checked against the sources below.

Sources