Claude Code Approval Rules Leak Thousands of Secrets to GitHub

Key Takeaways

• Apiiro reported on November 5, 2026, that Claude Code's "Yes, and don't ask again" option saves the full approved command, secrets included, to a project settings file.
• It found 1,379 distinct secrets in 1,122 public copies of .claude/settings.local.json on GitHub.
• A wider scan of agent artifacts found 2,539 secrets across 1,994 public repositories.
• Exposure is confirmed, but attacker use of these specific secrets has not been reported.

A Convenience Button Becomes a Credential Leak

Coding agents ask before running shell commands, and developers tire of clicking approve. Apiiro's research shows that the shortcut many choose stores the command text, passwords and tokens included, in a file that often ends up in public repositories. Apiiro found thousands of exposed credentials, from cloud keys to database passwords, tied to coding agent artifacts.

What We Know

When Claude Code asks to run a command, the developer can choose "Yes, and don't ask again." Claude Code then writes a permission rule to .claude/settings.local.json in the project. The rule is the command string itself.

If the command carried an inline secret, such as a database connection string with a password, that secret is now stored in plain text. Anthropic intends the file to be local, and Claude Code adds it to a global git ignore list. But that protection does not travel with a clone, and many copies were committed anyway.

Apiiro searched public GitHub between November 1 and 3. Independent reporting summarizes the results: 104,185 copies of the file in 103,617 repositories, with 1,122 copies holding 1,379 distinct real secrets.

A broader scan of agent histories and other artifacts raised the total to 2,539 secrets across 1,994 repositories. One organization Apiiro notified confirmed its key had been live.

What Happened

Any secret in a public repository is a target. Automated scanners, including the agentic tools Microsoft reported this month, search GitHub for credentials and can use them within minutes.

The secrets Apiiro found include cloud access keys, database credentials, SSH logins and API tokens. An attacker who finds one could sign in to production systems, read customer data, or run up costs on AI and cloud accounts.

Deleting the file does not end the exposure. The secret stays in git history, in forks and in any clone made before cleanup. Only revoking the credential removes the risk.

Standard secret scanners may also miss some cases. Tools tuned for known token formats can catch a GitHub token, but not a plain password embedded inside a shell command.

No attacker use of these specific secrets has been reported. The counts are identified exposures, not proof that each credential still worked.

Why It Matters

AI coding agents create new artifacts that hold sensitive context: approval rules, session histories, memory files and tool configurations. Developers rarely think of these as places where secrets live, and repository hygiene has not caught up.

The incident also shows how approval fatigue undermines safety prompts. A human in the loop is meant to slow risky actions, but the "don't ask again" path turns one decision into a permanent rule and writes it to disk with the secret attached.

This is not unique to one tool. Any agent that records commands, prompts or tool calls can leak whatever passed through them.

Teams should search current repositories and history for agent artifacts, revoke any exposed credential first, add agent files to repository ignore rules, and extend secret scanning to catch passwords inside command strings. Better still, keep secrets out of commands by using environment variables or a vault.

PointGuard AI Perspective

This leak sits where AI coding agents meet the developer's laptop. The secret was typed into a command, approved by a person, stored by the agent and pushed by git. Each step was ordinary, and together they published live credentials.

PointGuard AI Agentic Endpoint Security discovers coding agents running on developer machines, inspects their configuration files and flags risky settings, such as standing approvals that embed credentials. Security teams see which agents are installed, what they are allowed to run, and where their artifacts are stored.

PointGuard AI Data Protection adds content inspection. Prompts, commands and tool calls that carry passwords, keys or tokens are detected before they reach the model or a stored history, and policies can redact the secret or block the action.

Credential design matters as well. When agents use scoped, short-lived identities instead of developers' long-lived secrets, a leaked value expires before an attacker can use it.

The broader lesson is that every agent convenience feature is also a data store. Treat agent settings, histories and memory as sensitive files, and scan them with the same rigor as source code. Inventory across the developer fleet also shows which repositories and machines hold agent artifacts, so cleanup can be targeted rather than guessed.

Incident Scorecard Details

Total AISSI Score: 6.70/10

Criticality: 8, Exposed secrets include cloud, database and production credentials. AISSI weighting: 25%

Propagation: 7, Git history, forks and clones keep secrets exposed after deletion. AISSI weighting: 20%

Exploitability: 5, Exposure is confirmed, but attacker use is not established. AISSI weighting: 15%

Supply Chain: 7, Coding agent defaults and public repository workflows drive the risk. AISSI weighting: 15%

Business Impact: 6, High-risk public exposure with one confirmed live key; no proven losses. AISSI weighting: 25%

Sources

Third-Party Sources

• Apiiro: Coding agents leaking secrets on GitHub, "don't ask again"
• Tech Insider: Claude Code settings.local.json exposes 1,379 secrets on GitHub

PointGuard AI Sources

• PointGuard AI Agentic Endpoint Security
• PointGuard AI Data Protection