Apiiro finds Claude Code's "don't ask again" setting exposed credentials in 1,122 public GitHub files

Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files

Apiiro found that Claude Code's "don't ask again" option writes the full command, credentials included, into .claude/settings.local.json. On GitHub, 1,122 public files contain such secrets.

Why it matters: The study traces how credentials in approved commands land in project config files, and shows that scanning for key formats misses plain passwords inside commands.