Claude Code's "Don't Ask Again" Saves Passwords in Plain Text

Claude Code, Anthropic's coding agent, asks before it runs a shell command. Pick "Yes, and don't ask again" and it stops asking about that command, because it has written the whole command into a file in the project folder, .claude/settings.local.json. If the command had a database password or an API token typed into it, the secret now sits in that file as plain text until someone deletes the line. A saved line looks like this, with a made-up password: Bash(PGPASSWORD=hunter2 psql -h db.example.com -U app). Security firm Apiiro searched public GitHub for the file and reported on November 5, 2026 that 1,122 of 104,185 copies hold a real secret: a key in a known format, or a password beside a public server.

Jon's agents work in Claude Code all day, so on November 8 they ran the same kind of search on one of his machines. The fleet's own nine copies of the file held 35 saved rules and no secrets. Five of the nine were checkouts of one project that has carried the file in git, the tool that keeps a project's history, since August. The surprise was a folder of 1,796 projects downloaded from public GitHub in May for research. Sixty-five of them carried the file, 69 copies in all, and four held a password, token or key typed into a saved command: 20 rules, four of them aimed at a public server. Nobody has to search GitHub for these. Downloading a stranger's project brings them home.

Find the file before someone else does

1. List every copy on the machine:

   TerminalCopy

   find ~ -path '*/.claude/settings*.json' -not -path '*/node_modules/*' 2>/dev/null

2. In each project, print the saved rules that look like they carry a secret:

   TerminalCopy

   jq -r '.permissions.allow[]?' .claude/settings.local.json | grep -E 'PGPASSWORD=|sshpass -p|Bearer |://[^/ ]+:[^@ ]+@|(PASSWORD|SECRET|TOKEN|API_?KEY)[A-Z_]*='

3. Ask git whether it ever held the file:

   TerminalCopy

   git log --oneline --all -- .claude/settings.local.json

If step 2 prints anything, change that password or key first, then delete the rule. Apiiro's order is "rotate first, clean up second", because removing the file does not clear git history, forks or clones. If step 3 prints anything, run git rm --cached .claude/settings.local.json and add the file to the project's own .gitignore. A secret found in a project cloned from someone else is the owner's to change: tell them.

A secret scanner will not catch all of it. Apiiro ran gitleaks and TruffleHog, two common ones, over every file, and 215 of the 1,122 were flagged by neither. A password typed after PGPASSWORD= looks like an ordinary word.

What Anthropic said, and what it left open

Claude Code's documentation says the file stays out of git: the first time Claude Code writes it, it adds the file to the user's global git ignore list. That does not help a file someone already committed, because an ignore rule does nothing for a file git already tracks. Apiiro says that in 539 of the 1,105 projects it traced, a commit co-authored by Claude changed the file.

Boris Cherny, who leads Claude Code, replied on Hacker News on November 7: "Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this." He told people to use auto mode in place of saved permission rules. A reader answered that auto mode presumably still asks about sensitive commands and still saves the answer. His reply: "Yeah good catch." He said he would prototype a few fixes, basic secret scanning among them, before shipping one.

The problem is not new to Anthropic's tracker. A user filed it in August 2025, and a bot closed it for inactivity in January 2026 with no reply from the company.

Until a fix ships, the fix is a habit: keep the secret out of the command. Put it in an environment variable, a named value the shell holds, and let the command say $DB_URL, so that is all a saved rule can hold. When a command does carry a password, approve it once, not forever.