# Claude Code saved approved commands with passwords in them: how to check your repository

By Ivo Donker · 9 November 2026 — text: Claude (AI, Anthropic), checked against the sources
If you choose "Yes, and don't ask again" for a shell command in Claude Code, Claude Code writes that command as a permanent rule into .claude/settings.local.json in your repository. If the command contained a password or API key, that key now sits in the file too. According to research by security firm Apiiro, as reported by trade media, 1,122 public copies of that file on GitHub held at least one secret. Check whether the file is in git, rotate leaked keys and add the file to .gitignore.

This article explains how it happens, what the figures are and what you can do today. More on the tool itself is in our [Claude Code review](https://apps.llmnet.nl/en/claude-code-review); recent updates are collected in [Claude Code news](https://apps.llmnet.nl/en/claude-code-nieuws).

## How a password ends up in a settings file

Anthropic's [documentation](https://code.claude.com/docs/en/permissions) describes the behaviour. For shell commands, a "don't ask again" approval applies "permanently per repository and command". Claude Code stores the rule in .claude/settings.local.json at the root of the git repository, and the rule then applies in every session in that repository, including subdirectories and worktrees.

The rule is the text of the command. Approving a database command with the password in it (PGPASSWORD=..., mysql -p... or sshpass -p ...) stores that password in plain text in the file. The file is meant to be personal. The leak happens once someone commits it anyway and the repository is public.

## What Apiiro found

The figures come from [Apiiro research](https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again) that we could not open ourselves. We give them as [a summary on DEV Community](https://dev.to/gabrielanhaia/claude-codes-dont-ask-again-saved-secrets-in-1122-public-files-215-beat-both-scanners-2pi4) and [GBHackers](https://gbhackers.com/claude-codes-dont-ask-again-feature-exposed/) report them.

What Apiiro found
Measure | Value according to Apiiro (via trade media) | 

Public copies of .claude/settings.local.json examined | 104,185, in 103,617 repositories | 

Files with at least one secret | 1,122 | 

Distinct secrets in those files | 1,379 | 

Missed by both gitleaks and TruffleHog | 215 files | 

Total across all sources (including git history and chat logs) | 2,539 secrets in 1,994 repositories | 

According to the same summary, Claude Code was the only one of 16 compared coding agents that stores the full approved command in a project file by default. We could not verify that ourselves. We found no response from Anthropic to the research. The signal also appeared in the [Radar of November 8](https://radar.llmnet.nl/en/dag/2026-11-08) and in the [November 9 briefing](https://trending.llmnet.nl/en/briefing/2026-11-09#beveiliging).

## How to check your own repository

- Is the file in git? git ls-files .claude/settings.local.json shows whether it is tracked now; git log --all -- .claude/settings.local.json whether it was ever committed.

- Rotate first. A key that sat in a public repository counts as leaked, even if you rewrite history. Replace passwords and tokens before you clean up.

- Stop tracking. git rm --cached .claude/settings.local.json and add the path to .gitignore.

- Clean up the rules. /permissions in Claude Code shows the stored rules, and lets you delete rules that contain a secret.

- Prevent a repeat. Use variables instead of literal values (PGPASSWORD="$DB_PASSWORD") and block reading key files with a deny rule such as Read(./.env), which the documentation itself gives as an example.

Teams can add the file to their .gitignore templates by default and include folders such as .claude/, .cursor/ and .gemini/ in the secret scan of pre-commit and CI, git history included. More background on risks like this is in our overview [AI and cybersecurity](https://nieuws.llmnet.nl/en/ai-en-cybersecurity).

## What we did not check

We could not open Apiiro's research page; all figures come from third-party summaries. We did read the "don't ask again" behaviour and the storage in .claude/settings.local.json in Anthropic's documentation.

Checked on November 9, 2026.

This article was written with AI (Claude, Anthropic) and checked against the sources below.

## Sources

- Anthropic, Claude Code documentation, Configure permissions: [code.claude.com](https://code.claude.com/docs/en/permissions)

- Apiiro, original research (not read by us): [apiiro.com](https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again)

- Gabriel Anhaia, summary on DEV Community (November 7, 2026): [dev.to](https://dev.to/gabrielanhaia/claude-codes-dont-ask-again-saved-secrets-in-1122-public-files-215-beat-both-scanners-2pi4)

- GBHackers, report on 2,539 secrets in 1,994 repositories: [gbhackers.com](https://gbhackers.com/claude-codes-dont-ask-again-feature-exposed/)

- Report on X by @TheHackersNews: [x.com/TheHackersNews](https://x.com/TheHackersNews/status/2118960196987080801)