When you answer "Yes, and don't ask again" to a Bash command in Claude Code, it saves an allow rule in .claude/settings.local.json. That rule is the literal command text, so if the command held a password or API key, the secret is now stored in the file too. Anthropic's documentation confirms the option saves the rule in this local settings file.
On 5 November 2026, Apiiro researchers Shmulik Cohen and Matan Giladi published what they found on public GitHub (data collected 1–3 November). Of 104,185 public copies of the file, 1,122 held 1,379 distinct secrets, including 379 database passwords, 122 Supabase service-role keys, 43 SSH credentials (some root logins in sshpass commands), 23 AWS keys and 6 private keys. Counting Git history, shared settings and agent transcripts, the total is 2,539 secrets across 1,994 repositories; 734 existed only in older versions of the files.
Why it slips through: when Claude Code first writes the file inside a repository, it adds it to the developer's global Git ignore list. That protection stays on one machine and doesn't travel with the project, and Git ignore rules don't apply to files already tracked. Secret scanners also missed many: TruffleHog flagged 643 of the 1,122 files, gitleaks 564, and 215 were missed by both, often because passwords after PGPASSWORD=, sshpass -p or mysql -p have no recognisable prefix.
What is confirmed and what isn't: Apiiro did not test the credentials, so its figures show exposure, not breaches. It notified affected organisations on 2–3 November, and one confirmed its exposed key was live. Apiiro sells security products and its totals have not been independently replicated, though security firm ironPeak described the same problem in February 2026. A Claude Code GitHub issue about plaintext secrets in approved commands, opened in August 2025, was closed automatically in January 2026 for inactivity. The sources report no statement from Anthropic and no product change.
