Claude Code's 'Don't Ask Again' Put 1,122 Passwords on Public GitHub

AI 📅 Nov 8, 2026 ✍️ Aamir Raza

One Click Leaked 1,122 Secrets

Claude Code's 'Don't Ask Again' saved passwords in plain text — and they ended up on public GitHub. LexxWire

Pick 'Yes, and don't ask again' and Claude Code saves the full command, secret included, in .claude/settings.local.json. LexxWire

Apiiro scanned 104,185 public copies of the file on GitHub. About 1 in 100 held a real secret. LexxWire

The haul included 379 database passwords, cloud keys, API tokens and SSH logins. One company confirmed its key was live. LexxWire

Gitleaks flagged 564 of the files, TruffleHog 643. 215 slipped past both — and half the files had sat public for 217 days or more. LexxWire