# Major Security Breach Exposes Sensitive Data in Public GitHub Repositories

*Published November 9, 2026*
*Source: [https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html](https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html)*

## Executive Summary

Sensitive passwords and API keys have been exposed in public GitHub repositories due to a flaw in Anthropic's Claude Code. More than a thousand files containing these secrets have been identified, posing significant security risks that require immediate attention.

*This is a Premium edition: its actionable insights are available to sec-news.ai Premium members —*
*[read the story](https://www.sec-news.ai/news/major-security-breach-exposes-sensitive-data-in-public-github-repositories) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Sensitive information such as passwords and API keys have been found exposed in public GitHub repositories due to a flaw in Anthropic's AI coding assistant, Claude Code. This issue arises when developers approve commands with the 'Yes, and don't ask again' option, which results in the saving of these commands, including any secrets, in a project settings file named .claude/settings.local.json. Apiiro, a software security company, identified 1,122 public copies of this file containing secrets, although they did not test whether these credentials are still active. One company had confirmed its key was live after being notified. The persistence of these secrets is particularly concerning because removing the file from a project does not eliminate the leak; previous versions remain in the git history and forks. Therefore, it is crucial to rotate all passwords, tokens, and keys held in such files before attempting any cleanup.

Claude Code's mechanism, by default, requires user approval before executing most shell commands. However, selecting 'Yes, and don't ask again' leads to the command being saved in the settings file, allowing future runs without further prompts. This flaw is compounded by the fact that Claude Code does not add the file to the project's own .gitignore, meaning the protection is local to the user's system and does not accompany the project if shared. Apiiro discovered over 100,000 copies of the file in public repositories, with more than a thousand containing at least one secret, which includes database passwords, SSH logins, and API tokens. In many cases, these secrets provide direct access to sensitive databases and services.

The researchers recommend rotating all exposed credentials and thoroughly cleaning up project files to prevent further exposure. Despite previous reports of this issue, Anthropic has not provided a resolution. As of the last check, these files remain in the repositories' default branches, some for over 200 days, highlighting the urgent need for developers and organizations to address the flaw proactively.