# Researchers find secrets in 1,122 public Claude Code settings files

_Published Sunday, November 8, 2026 at 3:18 AM EST · Security, AI · Latest · Tier 2 — Notable_

![Researchers find secrets in 1,122 public Claude Code settings files — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZH3vYLZb9lP7mDLqy2h-upzdComeWIfjDX5siFUO3FM2HlUs03OTwirA1R2uzOZq_clptIVBsoaJNXIuf8LlTbXHFvzBJLRl1l3mqGVesHjgdmD86S_c-k2JY_t56xZqI0bnN6jXRDr92KlMw6X5BHzm5hqogpWflsERi9zrsMHSS_abAcvZMcUGovd8/s1700-nu-rw-lo-l85-e365/claude-code.jpg)

Security company Apiiro found at least one secret in 1,122 public copies of Claude Code's local settings file on GitHub, The Hacker News reported. Apiiro did not test whether the credentials still worked, although one notified company confirmed its key had been live.

Selecting "Yes, and don't ask again" can save an approved command verbatim, including passwords or tokens, in a project file. Claude Code's automatic exclusion uses one computer's global git settings and does not protect files already committed.

Deleting the file leaves secrets in repository history and forks. Researchers recommend rotating credentials before cleanup; neither gitleaks nor TruffleHog flagged 215 of the affected files in their tests.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html)

---
Canonical: https://techandbusiness.org/newswire/-t7Ya79Y3dt7dq0Z6Nbmku
Published: 2026-11-08T08:18:29.508Z
Story chronology: 2026-11-07T06:44:00.000Z
Retrieved: 2026-11-08T12:15:52.945Z
Publisher: Tech & Business (techandbusiness.org)