The convenience is the trap. When Claude Code asks whether to run a shell command, the “Yes, and don’t ask again” button is the fast path — approve once, never be asked again. What it also does is write that exact command, word for word, into a settings file inside the project folder. If the command contained a token or a password, the file now contains it too. And nothing in the project itself stops that file from ending up in a commit.

How a saved permission becomes a public secret#

The file is .claude/settings.local.json, and the saved commands live under a permissions.allow key. Claude Code does try to keep it out of Git — but it does so through the developer’s personal global git excludes, a setting that lives on one laptop. The project’s own .gitignore doesn’t list the file by default. So the protection doesn’t travel with the repository. Clone the project onto another machine, or share it with a teammate whose global excludes were never set, and the file can be committed and pushed like any other. Once it’s in the remote, it’s public — and deleting the line later doesn’t help, because Git history keeps every version.

That is the part developers keep missing in the thread that surfaced this: the leak isn’t a bug in the usual sense. The tool behaves as designed. The gap is that a per-machine safety net is guarding a per-project file, and the failure mode only shows up when the project moves.

A grid of blue file folders with one glowing red folder and a small key slipping out of it
One exposed settings file among thousands: Apiiro found more than 100,000 copies of the file in public repositories. Illustration generated for AI Frontier Post.

The numbers behind the warning#

Apiiro, a security firm, went looking for the file in the open. In a report published November 5, its researchers said they found 104,185 public copies of .claude/settings.local.json on GitHub, and 1,122 of them — about 1.1% — held at least one real secret. The counts came from data collected November 1–3, with files as of November 2. Across every source the firm checked, it counted 2,539 distinct real secrets in 1,994 repositories. GitLab, publishing its own guidance today, repeats the headline figures and adds that hundreds more secrets survived only in history, in files that had since been deleted.

What Apiiro foundCount
Public copies of the settings file104,185
Copies holding at least one real secret1,122 (1.1%)
Distinct secrets in those files1,379
Distinct real secrets, all sources checked2,539
Repositories affected1,994

Those are only the copies Apiiro could see. Private repositories are invisible to that kind of scan, so the public count is the floor, not the ceiling.

What Anthropic is doing about it#

Anthropic has acknowledged the problem. Boris Cherny, who leads Claude Code, responded on Hacker News on November 7, saying the team is looking into what it can do to prevent this and plans to prototype approaches including basic secret scanning. That reply was noted in an update Apiiro added to its post on November 8. Nothing in the sources published so far describes a shipped fix — for now, the practical protection sits with the user.

What to do tonight#

If you use Claude Code, the cleanup is short. GitLab’s guidance and the developers in the thread converge on the same steps:

  • Add the file to your project’s .gitignore — and to your global excludes as well, so the protection exists in both places.
  • Check whether it was ever committed. Search your history, or run a scanner such as gitleaks over the repo.
  • Rotate any secret that was in the file. Deleting the line, or the file, doesn’t remove it from history.
  • Turn on push-time protections where your host offers them — GitLab’s Secret Push Protection and Secret Detection are its versions; GitHub has push protection too.
  • Stop pasting secrets into commands the agent runs. Pass them through environment variables or a secrets manager instead.
Hands typing on a laptop whose screen shows a shield with a check mark and two keys, one old and one new
Rotating a compromised credential beats deleting the file: git history keeps every version. Illustration generated for AI Frontier Post.

What to watch#

Two things. First, whether Anthropic ships the secret-scanning prototype Cherny described, and whether it lands as a default or an opt-in. Second, whether the count of exposed files keeps growing — Apiiro’s snapshot is from early November, and every new “don’t ask again” approval is another chance for a secret to land in a committable file. One disclosure worth noting: the developer whose Reddit thread spread the warning also maintains a tool that scans for exactly this problem, and says so in the post. The numbers check out against Apiiro and GitLab regardless — but the tool has a stake in the story being told.

Sources: GitLab, ‘How to prevent leaks from Claude Code’s “Don’t ask again” file’ (November 11, 2026), here; Apiiro, ‘Coding Agents Copy Your Secrets to a Hidden File. Thousands Are on GitHub’ (November 5, 2026), here; the r/ClaudeAI thread, here. Cover image: a laptop with a shattered padlock over its keyboard. Illustration generated for AI Frontier Post. Second image: file folders with one glowing red and a key slipping out. Illustration generated for AI Frontier Post. Third image: hands typing while a shield and fresh key replace an old one on screen. Illustration generated for AI Frontier Post.