Claude Code “Don’t ask again” can save your secrets

What changed

A standing approval can store the exact command you approved, secret included. Anthropic’s settings docs say Claude Code writes .claude/settings.local.json the first time you give a standing approval such as “Yes, and don’t ask again” for a Bash command, and saves it as an allow rule.

Apiiro, a security company, reports that when the rule is a single exact command, any password or token typed into it is saved in plain text. Apiiro did not test whether the secrets it found still work. The Hacker News says the related bug reports got no reply from Anthropic.

What Apiiro found

• As reported by The Hacker News, Apiiro searched public GitHub and found 104,185 copies of the file. About 1.1% of them, 1,122 copies, hold at least one secret, 1,379 different secrets in total.
• Per The Hacker News, those include 379 database passwords, 43 SSH logins, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys.
• Deleting the file does not remove the leak, because older versions stay in git history and in forks.

Why the built-in guard may not help

Anthropic’s docs say Claude Code adds the file to your global git excludes the first time it writes it, so it stays out of your commits on that computer. That setting lives on one machine.

It does not travel with the project, and it does not fix a file that was already committed.

What to do

1. Rotate any password, token or key .claude/settings.local.json has ever held, before you clean up.
2. Open the file in each project and delete every rule that contains a secret.
3. If the file is tracked, run git rm --cached .claude/settings.local.json and add it to the project’s own .gitignore.
4. Refer to secrets as variables such as $DB_URL, and approve patterns like Bash(npm run:*) instead of single commands.