Claude Code “Don’t Ask Again” Password Leak: How to Check Your Repos in India

If you use Claude Code and you have ever clicked “Yes, and don’t ask again” on a command that had a password in it, stop for two minutes and read this. Security firm Apiiro has found that the Claude Code “Don’t Ask Again” password leak is not a theory: 1,122 public copies of a Claude Code settings file on GitHub contain real-looking secrets, from database passwords to cloud keys. The fix is simple, but the order you do it in matters.

Here is what happened, how to check your own projects, and what Indian developers and freelancers should do today.

What Apiiro actually found

Claude Code, Anthropic’s coding agent that runs in your terminal, asks permission before it runs most shell commands. Pick “Yes, and don’t ask again” and it saves an allow rule in a file inside your project called .claude/settings.local.json. Next time, a matching command runs without asking.

Sometimes that saved rule is a pattern, like npm test *. Sometimes it is the exact command you just approved, word for word. If that command was a psql connection string with your database password in it, the password is now sitting in a JSON file in plain text.

Apiiro’s researchers searched public GitHub and, according to its write-up and reporting by The Hacker News, found 104,185 copies of that file across 103,617 repositories. About 1.1% of them, 1,122 files, held at least one secret, adding up to 1,379 distinct secrets. The Hacker News lists 43 SSH logins for public servers and 42 tokens for GitHub, GitLab and npm among them, and other roundups put the count of AWS keys at 23. Apiiro says it did not test whether the credentials still work, though one company it contacted confirmed its key had been live.

The Japanese tech site LATENT, which checked the numbers against the original report, adds two details that should worry anyone relying on automated tools. The popular scanners gitleaks and TruffleHog together missed about one in five of the files with secrets, because a password typed inside a command does not look like a standard API key. And 734 secrets survive only in old commits, not in any current file.

Why .gitignore did not save people

Anthropic did think about this. According to Claude Code’s settings documentation, the first time it writes the local settings file inside a git repo, it adds the file to your global git excludes on that computer.

That protection lives on one machine. It does nothing if you open the same project on a second laptop, inside a Docker container, on a cloud dev box, or in a folder you copied. It also does nothing for a file that was already committed. Claude Code does not add the file to the project’s own .gitignore, so the safety net never travels with the code.

LATENT’s analysis found that in nearly half of the repositories with secrets, a commit listing Claude as co-author had touched this file. In plain words: the agent itself often committed the thing that leaked.

How to check if your Claude Code settings leaked a password

This is the part that matters. Apiiro’s advice, as reported by The Hacker News, comes down to six steps. We have put them in the order that actually protects you.

1. Search your repos, including history. Look for .claude/settings.local.json and .claude/settings.json in every repository you own or your company owns. Do not stop at the current files. Run git log --all -- .claude/settings.local.json to see if the file was ever committed, even if it is gone now.
2. Rotate first, clean up second. Change every password, token and key the file has ever held. Deleting the file does not help on its own, because the old version stays in git history and in any forks someone already made.
3. Stop tracking the file. Run git rm --cached .claude/settings.local.json and add .claude/settings.local.json to the project’s own .gitignore, so the rule protects every teammate and every machine.
4. Open the file on your own computer. Even if it was never pushed, read it and delete any rule that contains a secret. A laptop gets lost or a folder gets zipped and shared over WhatsApp more often than people admit.
5. Keep secrets out of commands. Refer to them as environment variables, such as $DB_URL, loaded from a secrets manager or a .env file that is ignored. Then the saved rule stores the variable name, not the password.
6. Approve patterns, not one-off commands. A rule like Bash(npm run:*) is far safer than saving a full command line.

If you used Claude Code on a client project, tell the client. Rotating their keys quietly and hoping is not a plan.

The India angle: freelancers, students and small teams

India has one of the biggest developer communities on GitHub, and a lot of that work happens in public: college projects, hackathon repos, portfolio code, small agency sites. That is exactly the kind of repo where someone tests a database connection with Claude Code at 1 AM, clicks “don’t ask again”, and pushes everything before submission.

Claude Code is available in India through Anthropic’s paid Claude plans and the API, and plenty of Indian freelancers now use coding agents to ship client sites and apps faster. The risk is highest for three groups:

• Students and job seekers who keep public repos as a portfolio. Recruiters are not the only ones reading them.
• Freelancers and small agencies who reuse one laptop across many client projects, often with production database passwords.
• Startups that let several people run Claude Code on different machines and containers, where the global exclude simply does not exist.

If you also juggle other coding agents, our explainer on ChatGPT Codex usage limits in India is a useful reminder that each tool has its own quirks. And as always-on agents like Perplexity Teammates get access to more of our accounts, the same lesson applies: know what the agent remembers and where it writes it.

Is Claude Code still safe to use?

Yes, with sensible habits. This is not a hack of Anthropic, and nobody broke into anything. It is a design choice, saving approvals as plain text, colliding with a very human habit, pasting passwords straight into commands. Apiiro says it shared the research with Anthropic before publishing. We could not find an official product change announced at the time of writing, so treat the steps above as your job, not Anthropic’s.

The wider picture is clear enough. The same week, Palo Alto Networks was reported to be in talks to buy Clutch Security, a startup that tracks the passwords and tokens AI agents use, for around $500 million. Securing what agents can see and store is quickly becoming its own industry.

Our take

“Don’t ask again” feels like a convenience button. It is really a “write this down forever” button. The tool did what it promised; the problem is that most of us never wondered where that promise was stored.

The good news is that the fix costs nothing. Add one line to .gitignore, move secrets into environment variables, rotate anything that has ever touched that file, and approve patterns instead of exact commands. Do it today, before a stranger with a search bar does the checking for you.

FAQ

What is the Claude Code “Don’t Ask Again” leak?

When you choose “Yes, and don’t ask again” on a command prompt, Claude Code can save that exact command, including any password or key typed into it, in .claude/settings.local.json. Apiiro found 1,122 public GitHub copies of this file holding at least one secret.

Is deleting settings.local.json enough?

No. Old versions stay in git history and in forks. Rotate every credential the file ever held first, then remove it with git rm --cached and add it to the project’s .gitignore.

Do I need to worry if my repo is private?

The risk is lower, but not zero. Anyone with access to the repo can read the file, and private repos sometimes become public or get shared. Clean the file and keep secrets in environment variables anyway.

Sources: Apiiro research (via The Hacker News), LATENT’s analysis of the Apiiro report, Claude Code permissions and settings documentation, Kill The AI’s 8 November roundup citing TechCrunch on Palo Alto Networks and Clutch.