Claude Code’s “Don’t Ask Again” file exposes passwords and keys in 1,122 public GitHub copies

Claude Code can save an approved command word-for-word in .claude/settings.local.json, including a password or key entered in the command. Apiiro found 1,122 public copies on GitHub containing at least one secret; the researchers did not test whether the secrets still work, but one notified company confirmed that its key was active.