Claude Code 'Don't Ask Again' Feature Leaks 2,539 Secrets in Public GitHub Repos

Apiiro discovered 2,539 distinct real secrets across 1,994 public GitHub repositories, primarily stored in Claude Code's .claude/settings.local.json file.
The leak occurs when developers select "Yes, and don't ask again" for commands containing secrets; Claude Code saves the full command string, including the secret, to a local JSON file that is often committed to version control.
1,122 of the 104,185 public copies of the file contain real secrets, affecting 63 organizations, including a database vendor's admin cloud key, a production Azure Postgres password, and a Square production token.
Standard secret scanners like gitleaks and TruffleHog miss a significant portion of these leaks, failing to flag 215 of the 1,122 affected files because the secrets are passwords embedded in command lines rather than recognizable key formats.

Exposure Details

The most common exposed credentials are database passwords (379) and Supabase service-role keys (122), followed by Supabase account tokens (103) and SSH logins (43).
Secrets are also found in shared .claude/settings.json files (298 instances), agent chat transcripts (120 files), and handoff notes (33 files).
In 539 of the traced repositories, commits co-authored by Claude Code directly modified the file containing the secrets.

gitleaks flagged 564 of the 1,122 files with secrets, while TruffleHog flagged 643.
215 files were missed by both scanners, typically because the secret was a password typed into a command (e.g., PGPASSWORD=, sshpass -p) rather than a standard API key format.
The Shai-Hulud npm worm previously used TruffleHog to steal credentials, highlighting the risk of these files remaining on developer machines even if not committed to git.