Claude Code's 'Don't Ask Again' Feature Leaks Secrets into Public GitHub Repos

Anthropic's AI coding assistant Claude Code has a convenience feature that is quietly turning into a security liability. When a developer approves a command with the "Yes, and don't ask again" option, the tool can persist that command verbatim — including any passwords, API keys, or tokens embedded in it — into a project-level settings file. According to software security firm Apiiro, that behavior has resulted in 1,122 public copies of such files sitting in GitHub repositories, where anyone can read the exposed credentials.

The finding, reported by The Hacker News, highlights a recurring theme in the rush to adopt agentic coding tools: the friction users are trying to eliminate is often the same friction that keeps secrets out of source control.

How the Leak Happens

Claude Code, like other terminal-based AI agents, asks for permission before executing commands that could modify a system or touch sensitive resources. To reduce prompt fatigue, it offers a "don't ask again" option that records the approved command so it won't need to be confirmed in the future. That record is written to a project settings file that is meant to be shared or committed alongside the codebase.

The problem is what developers sometimes put inside those commands. A typical example is an inline credential — a database connection string with a password, a curl request carrying a bearer token, or an environment variable assignment containing an API key. If the developer approves that exact command with "don't ask again," the secret is copied into the settings file in plaintext. From there, a routine git add and git push publishes it to the world.

Apiiro's research identified 1,122 public GitHub repositories containing these files with exposed secrets. The exposure is not the result of a sophisticated attack; it is the byproduct of a usability feature interacting with well-documented developer habits around hardcoded credentials.

Why This Keeps Happening

Secret sprawl in repositories is not new. GitHub has long struggled with leaked tokens, and the platform has invested heavily in secret scanning and push protection to catch them before they land. What makes the Claude Code case notable is the mechanism: the leak is generated by the assistant's own configuration, not by a developer manually pasting a key into source code.

Several factors compound the risk:

  • Convenience bias. The "don't ask again" option exists precisely to remove friction. Users who select it are often in a flow state and unlikely to audit what was saved.
  • Opaque persistence. Settings files are easy to overlook. Many developers do not realize that an approved command is stored verbatim rather than as a sanitized pattern.
  • Shared project scope. Because the file lives at the project level, it is a natural candidate for committing to version control, especially in repositories where configuration is checked in deliberately.
  • Agentic tooling maturity. AI coding agents are evolving faster than the guardrails around their configuration surfaces. Secret handling in these tools is still catching up.

The Broader Pattern

This incident fits a wider trend RedSide has tracked throughout the year: AI-assisted development tools are expanding the attack surface in ways that traditional security controls were not designed to address. Prompt injection, over-permissive tool access, and now credential persistence in agent configuration all stem from the same root cause — agents are given broad latitude to act, and their artifacts are not always treated as sensitive.

It also echoes lessons from earlier tooling generations. CI/CD configuration files, .env files, and shell history have all been sources of leaked secrets. Each new layer of automation tends to reintroduce the same class of mistake under a different filename.

What Developers and Security Teams Should Do

Apiiro's disclosure is a reminder that convenience features need to be paired with hygiene. Practical steps include:

  1. Audit existing settings files. Search repositories for Claude Code project settings and inspect any stored commands for embedded credentials.
  2. Rotate anything exposed. Any secret that has touched a public repository should be treated as compromised, regardless of how briefly it was visible.
  3. Avoid inline secrets in commands. Use environment variables, secret managers, or credential helpers rather than passing secrets directly on the command line.
  4. Add settings files to .gitignore where appropriate, and enable GitHub secret scanning and push protection across all repositories.
  5. Review "don't ask again" approvals as part of code review, particularly in repositories that are public or shared broadly.

The Takeaway

Claude Code's leak is less about a single bug and more about a design tension that will define the agentic era: the features that make AI assistants pleasant to use are often the ones that quietly accumulate sensitive state. The 1,122 exposed repositories are a measurable symptom, but the underlying pattern — automated tools persisting secrets in places nobody thinks to check — is likely broader than any one vendor's configuration file.

Security teams should treat AI agent configuration as part of the attack surface, scan for it, and assume that somewhere in their organization, a developer has already clicked "don't ask again."

Source: The Hacker News