Claude Code's 'Don't Ask Again' permission file leaked thousands of secrets to public GitHub
Claude Code saves approved commands verbatim in .claude/settings.local.json, and researchers found 1,122 public GitHub repos containing 1,379 secrets, including an admin-level vendor API key.
Read the full story at The Hacker News (security) ↗
Timeline · 9 reports
- 2026-11-08 18:56 · DEV Community — Machine Learning
Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files - 2026-11-08 18:38 · DEV Community — AI
The File Claude Code Writes When You Choose "Don't Ask Again" - 2026-11-08 17:13 · DEV Community — AI
Don't Ask Again, Publish Forever: How a Claude Code Permission File Leaked 2,539 Secrets to GitHub - 2026-11-08 16:45 · DEV Community — AI
Claude Code's "Don't Ask Again" Leaked Developers' Secrets to Public GitHub — Explained Honestly - 2026-11-08 13:01 · r/ClaudeAI
If you ever clicked “Yes, and don’t ask again” in Claude Code, check one file before your next push - 2026-11-07 23:02 · DEV Community — AI
Claude Code's 'Don't Ask Again' Saved Secrets in 1,122 Public Files. 215 Beat Both Scanners - 2026-11-07 20:45 · Hacker News Front Page
Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files - 2026-11-07 17:06 · DEV Community — AI
Claude Code's don't-ask-again file held 1,379 secrets in 1,122 public repos: what settings.local.json really saves - 2026-11-07 06:44 · The Hacker News (security)
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub