Claude Code's Don't Show Again Option Leaks Secrets to GitHub, Apiiro Finds 2,539
Apiiro found that when Claude Code users pick "Don't show again" to allow a command, the command's contents, including any passwords, are written into the project's .claude/settings.local.json file.
1 source 1d ago
Reporting from 1 source: GIGAZINE.
Why it matters
The leak comes from a convenience feature working as designed, so the exposure sits in ordinary command text that format-based secret scanners are not built to catch, and Apiiro found 215 of the 1,122 affected files that neither of two detection tools flagged.
Key Facts
- Apiiro published its investigation results on November 5, 2026.
- Apiiro found 104,185 .claude/settings.local.json files public on GitHub.
- Of those files, 1,122 contained 1,379 secrets.
- Service API tokens were the most common secret type at 398, followed by database passwords at 379.
- Apiiro confirmed 2,539 secrets in total across all sources, including Git change history and AI conversation logs.
In results published November 5, 2026, the security firm reported 104,185 of those files public on GitHub, 1,122 of them holding 1,379 secrets, and 2,539 secrets confirmed across all sources.
Apiiro's count of 104,185 public .claude/settings.local.json files on GitHub is the part that matters. The file is meant to stay on the developer's PC, and Claude Code has a mechanism to keep it out of Git, but that exclusion setting lives on each individual machine and does not follow the project to another PC. Once a file is under Git management, the exclusion alone cannot protect it.
Service API tokens were the most common secret type in the public files at 398, with database passwords second at 379. Files of 8KB or larger carried secrets 9.9% of the time. The rest of the 2,539 total came from Git change history, team-shared configuration files, and AI conversation logs.
Written with AI by Yomimono from the 1 cited source below, including Japanese-language reporting where cited. See our editorial policy.
Add Yomimono as a preferred source on Google