Claude Code's 'Don't Ask Again' File Exposes Passwords and API Keys on GitHub

Modern AI-powered developer workflows prioritize speed and frictionless execution, but that convenience often carries hidden security debt. Recent threat intelligence findings reveal that Anthropic’s popular terminal-based coding assistant, Claude Code, has inadvertently leaked plain-text passwords, database credentials, and production API keys across more than a thousand public repositories on GitHub. The exposure stems from a well-intentioned feature designed to minimize repetitive user prompts, turning routine command-line approvals into an accidental vector for sensitive credential leakage.

Quick Verdict / Key Takeaways:

• Core Development: Anthropic's Claude Code assistant is inadvertently leaking sensitive passwords and API keys into public GitHub repositories.
• Technical Specs / Root Cause: Selecting the "Yes, and don't ask again" prompt saves full terminal commands—including inline secrets—word-for-word into local project configuration files.
• The Bottom Line: Security firm Apiiro discovered 1,122 vulnerable public copies; developers must audit their repositories, scrub history, and stop hardcoding secrets into terminal prompts.

How Convenience Turned Into a Security Liability

The root of the vulnerability lies in how Claude Code handles persistent user permissions. When developers utilize AI coding agents in their local terminal environments, the tool frequently requests approval to execute shell commands, run build scripts, or query external APIs. To streamline this process and prevent developer fatigue, Anthropic built a persistent permission mechanism. When a user checks or selects the "Yes, and don't ask again" option, the assistant records that specific authorization for future execution.

However, the implementation serializes the entire command string verbatim into project-level configuration and settings files. If a developer runs a command like export DATABASE_URL=postgres://admin:[email protected]:5432/main or passes an active production API key as an inline flag during an approved build step, that exact string is written directly to disk. When developers subsequently push their local project directories to version control systems without a pristine .gitignore setup, these configuration files are hoisted straight onto public or private remote repositories.

Security telemetry captured by Apiiro identified over 1,100 public GitHub repositories containing these exposed configuration artifacts. Because the AI agent records commands precisely as typed by the user, any transient credential passed during a debugging session or an environment setup phase becomes a permanent fixture of the project's state. This operational oversight highlights a broader systemic risk in agentic coding tools: optimizing for frictionless user experience frequently undermines fundamental least-privilege security principles.

The Mechanics of Secret Sprawl in Agentic Workflows

The architectural flaw centers on the boundary between transient terminal execution and persistent state storage. Command-line interfaces have historically relied on transient inputs; a password typed into a prompt vanishes from shell history if properly configured, or sits in a local bash history file that developers are accustomed to managing. Introducing an autonomous or semi-autonomous coding agent shifts this paradigm. Claude Code acts as an intermediary, capturing state to evaluate context and determine whether subsequent operations require user intervention.

When permission is granted persistently, the system must cache the authorization rule. Rather than storing abstract permission grants or function hashes, the underlying configuration files log the exact terminal strings authorized by the developer. This creates an unencrypted ledger of past administrative actions, environment variable injections, and deployment scripts.

For instance, if a developer uses Claude Code to interact with cloud infrastructure management CLIs—such as AWS CLI, Google Cloud SDK, or Kubernetes kubectl—the command strings often incorporate authorization tokens, client secrets, or auth endpoints. Storing these strings locally is risky enough on a shared workstation; when mirrored to version control repositories, the blast radius expands instantly to anyone with read access to the codebase. Threat actors actively monitor GitHub ingestion streams for leaked tokens, meaning that exposure windows of even a few minutes can result in automated credential harvesting, unauthorized resource provisioning, and lateral movement within corporate networks.

Remediation and Defensive Engineering for AI Coding Assistants

Mitigating the risks introduced by Claude Code and similar terminal-based AI agents requires a multi-layered defensive posture that spans local environment hygiene, version control enforcement, and enterprise policy. Development teams must immediately audit their existing repositories for stray configuration files generated by AI tooling, ensuring that local persistence files are strictly excluded from git tracking.

Developers should adopt strict operational habits when interacting with AI coding assistants. Secrets, tokens, and production passwords must never be passed as inline arguments or environment variable declarations within terminal commands that an AI agent might parse and persist. Instead, teams should rely on secure secret managers, local credential helpers, or environment files explicitly bound to .gitignore exclusions before any command execution occurs.

Furthermore, engineering organizations need to implement automated secret scanning tools within their CI/CD pipelines and pre-commit hooks. Tools like GitGuardian, TruffHog, or GitHub’s native secret scanning can intercept accidental credential commits before they reach remote repositories. As agentic AI tools mature, vendors and consumers alike must demand transparent state management, ensuring that convenience features never compromise the cryptographic integrity of modern software supply chains.

Frequently Asked Questions

What causes Claude Code to leak passwords and API keys?

The leak occurs when developers select the "Yes, and don't ask again" prompt in Claude Code. The tool saves the full terminal command—including any plain-text passwords or inline API keys—verbatim into local configuration files that are subsequently pushed to GitHub if not properly ignored.

How many repositories were affected by this configuration exposure?

Security research conducted by Apiiro identified 1,122 public GitHub repositories containing vulnerable Claude Code configuration files with exposed sensitive data.

How can developers prevent future credential leaks from AI tools?

Developers should audit their .gitignore files to ensure AI configuration artifacts are never tracked, avoid passing raw secrets inline within terminal commands, and integrate automated secret scanners into their pre-commit hooks and CI/CD pipelines.