Claude Code’s ‘don’t ask again’ button has a secrets-spilling problem

Publisher excerpt From CSO Online

A configuration file meant to store local command permissions on Anthropic’s Claude Code is exposing thousands of API keys, database credentials and other secrets, according to findings by GitGuardian. The code security firm identified 31,088 distinct secrets in Claude Code’s “.claude/settings.local.json” files across 23,276 public GitHub repositories. Of those, 5343 were still valid when GitGuardian detected them. The exposed credentials include database connection strings, cloud provider tokens, SSH passwords, Google API keys, and AU service credentials. “Monthly leaks in settings.local.json peaked at 12,535 occurrences in April 2026, then fell to 959 by October, and we do not yet know what changed,” GitGuardian researcher Guillaume Valadon said in a blog post. Apart from source code repositories, the exposure included secrets embedded in publicly accessible Docker Hub images. The problem, Valadon explained, lies with how Claude Code handles command approvals. Command approvals turn into credential storage Claude Code asks developers for permission before executing certain shell commands. When a developer selects the “Yes, and don’t ask again” option, the tool saves an allow rule in .claude/settings.local.json, a project-level configuration file. The catch is that the saved rule contains the actual command string, including any credentials embedded in it. For instance, a developer asking Claude Code to interact with an API might approve a curl command containing an API key in its HTTP header. Claude Code then stores that entire command as an approved rule, leaving the credential in the configuration file. Although Claude Code automatically adds the file to its local Git ignore settings, that protection does not necessarily carry over to other machines or repositories, Valadon said. Developers can accidentally commit the file, particularly when working across different clones or when the file has already been tracked. Git Guardian found that 67% of the occurrences in settings.local.json for which it could establish validity were working credentials. Database identifiers accounted for the largest category of valid secrets, with 2280 distinct credentials, followed by cloud provider tokens and AI tokens. It was also noted that conventional secret scanners could miss a substantial portion of the exposure. Passwords embedded in command-line arguments and environment variable assignments often lack the recognizable formats that provider-specific detection rules look for. Leaked credentials on Docker Hub GitGuardian also examined public Docker Hub images and found 613 distinct secrets in Claude Code settings files, 99 of which were valid when detected. The credentials appeared across 543 image repositories and 7625 tags. According to Valadon, the problem arises when developers use Docker’s “COPY..” instruction to copy an entire project working directory into an image. Unlike Git, Docker does not automatically respect the repository’s .gi…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.