Claude Code 'Don't Ask Again' Files Expose Live Secrets, Study Finds

What happened

A configuration file that Anthropic's Claude Code uses to store locally approved commands is exposing live credentials in public code repositories, according to research published by code security firm GitGuardian. The firm identified 31,088 distinct secrets in "settings.local.json" files across 23,276 public GitHub repositories. Of those, 5,343 were still valid when GitGuardian detected them.

The exposed material includes database connection strings, cloud provider tokens, SSH passwords, Google API keys and other service credentials. GitGuardian also found secrets embedded in publicly accessible Docker Hub images, so the exposure extends beyond source code repositories.

GitGuardian researcher Guillaume Valadon wrote in a blog post that monthly leaks from these files peaked at 12,535 occurrences in April 2026 and fell to 959 by October. The firm does not yet know what changed. Valadon attributed the underlying problem to how Claude Code handles command approvals, the feature behind the tool's "don't ask again" option.

Why it matters

AI coding agents now operate inside developers' working environments, with permission to run commands, reach databases and call cloud services. Any mechanism that remembers those permissions is therefore part of the security surface, not just a convenience setting. For engineering and technology leaders adopting AI tools, the story is a reminder that governance has to cover the configuration files and approval records these tools create, not only the code they produce.

The story also illustrates a familiar behavioural pattern. Repeated permission prompts create approval fatigue, and a "don't ask again" option removes that friction by design. The benefit is real, but the people clicking it rarely see where that decision is stored or what sensitive detail it may carry with it.

By the numbers

• 31,088 distinct secrets found in "settings.local.json" files
• 23,276 public GitHub repositories affected
• 5,343 exposed secrets still valid when detected
• 12,535 monthly leak occurrences at the April 2026 peak
• 959 monthly occurrences by October

The Renascence take

Most readers will focus on the size of the leak and miss the design lesson underneath it. A convenience feature that reduces prompts is a behavioural shortcut, and shortcuts that remove friction also remove the moments when users reflect on what they are approving.

The real failure is not that developers clicked "don't ask again", but that the product made a security decision feel like housekeeping. Good service design makes the cost of a permission visible at the point of consent, and stores it somewhere people can audit and revoke. Customer-obsessed operators should treat AI agent settings as sensitive data: review what gets persisted, scope approvals tightly, and build secret scanning into the workflow before the file ever reaches a public repository.