Claude Code's 'Yes, and don't ask again' saves the approved command, secrets included, in .claude/settings.local.json: Apiiro finds a real secret in 1,122 of 104,185 public copies of the file on GitHub, and common secret scanners miss a fifth of them

Apiiro reports that when a developer chooses "Yes, and don't ask again" on a shell command that carries a secret, Claude Code saves that exact command, secret included, in plain text in .claude/settings.local.json inside the project (Apiiro, 2026-11-05). Anthropic's documentation confirms that the approval is saved as an allow rule in that file, and that Claude Code adds the file to the user's global git excludes the first time it writes it, so it stays out of that user's commits (Anthropic, 2026-11-04). Apiiro points out that this protection lives in one user's git settings on one machine: it does not cover a folder that becomes a repository later, a clone on another machine or a file already committed, and the rule never goes into the repository's own .gitignore (Apiiro, 2026-11-05).

Apiiro found 104,185 public copies of the file in 103,617 repositories; 1,122 of those files hold at least one secret, 1,379 distinct secrets in all: 379 database passwords, 122 Supabase service-role keys, 43 SSH logins, 42 GitHub, GitLab and npm tokens and 23 AWS keys among them (Apiiro, 2026-11-05). Counting git history, the shared settings.json and saved agent transcripts, it counts 2,539 secrets in 1,994 repositories (Apiiro, 2026-11-05). Gitleaks flagged 564 and TruffleHog 643 of the 1,122 files, and 215 were flagged by neither, mostly because a password typed after PGPASSWORD=, sshpass -p or mysql -p looks like an ordinary word in a command line (Apiiro, 2026-11-05).