Researchers at Apiiro have found 2,539 secrets exposed across 1,994 public GitHub repositories, leaked through a local configuration file that Claude Code writes when developers choose its “Yes, and don’t ask again” setting. The findings were published on November 8.
How the Don’t-Ask-Again Setting Writes Secrets Into a Config File
When a developer selects “Yes, and don’t ask again,” Claude Code records the exact command, including any password embedded in it, in a local configuration file. Developers then commit that file to public repositories, which publishes the stored command and its secret.
Apiiro researchers Shmulik Cohen and Matan Giladi scanned 104,185 public copies of the file between November 1 and 3.
Scan Results: 1,379 Secrets on Default Branches
On default branches, the scan found 1,379 distinct secrets across 1,122 active files. Counting git history, shared settings and chat transcripts raised the total to 2,539 secrets across 1,994 repositories. The research counts the extra locations because a secret removed from the current file can persist in older commits.
What Kinds of Credentials Were Exposed
The exposed credentials include 398 service API tokens, 379 database passwords, 149 AI model API keys, 122 Supabase service-role keys, 110 Google API keys, 103 Supabase account tokens and 43 SSH logins.
Worst Cases Found in the Scan
The researchers highlighted three worst cases: an admin-level cloud key for a database vendor, a Square production token and an owner password for a medical-records database. The researchers did not test credentials or contact the hosts, so the validity of the exposed secrets was not verified.
File Size as a Predictor of Leaked Secrets
Larger files were more likely to contain secrets. One in ten files over 8 KB held a real secret, compared with fewer than one in 500 for files under 500 bytes. The pattern is consistent with long-lived allowlist files accumulating many approved commands over time, each a possible container for an embedded credential, though the research does not state that explanation.
Scale and Open Questions About Vendor Response
The scan shows how a convenience feature in an AI coding tool can turn routine developer approvals into public credential exposure at scale. The file is a record of approved commands, and because commands often embed credentials as arguments, the record doubles as a store of secrets that is easy to commit by accident.
Gaps in the Published Findings
The source coverage of the research does not describe a response from Anthropic or any change to the product’s behavior, and the sources do not say whether affected credentials have been rotated or whether the exposed services were notified. The research also does not report any misuse of the credentials it found.
The numbers show the exposure is broad, including production payment tokens and database access, but they rest on pattern matching of public files rather than confirmed testing. What the scan establishes is that a very large number of public repositories hold secrets in this file. How many remain valid is not known.
The Research Method and What It Counted
Apiiro’s scan covered 104,185 public copies of the configuration file, collected over three days in early November. The numbers distinguish between secrets that exist on default branches, 1,379 across 1,122 active files, and the larger set of 2,539 that includes git history, shared settings and chat transcripts. The wider count reflects where developers’ commits and conversations have left secrets behind.
The researchers did not test the credentials or contact the hosts they belonged to, which keeps the findings within passive observation of public files. The exposed categories show the range of what developers embed in commands: service tokens, database passwords, AI model keys, Supabase service-role keys and Google keys, along with SSH logins.
The finding that larger files are far likelier to hold secrets suggests the risk grows as a developer accumulates approved commands. Researchers Shmulik Cohen and Matan Giladi published the findings on November 8.
