{"rewrite":{"id":"r_e205bce3b5e02c88a9347878","clusterId":"c_e5ec56270bd96a596b561481","slug":"claude-code-s-don-t-show-again-option-leaks-secrets-to-github-apiiro-finds-2-539","model":"deepseek-v4-1-flash","headline":"Claude Code's Don't Show Again Option Leaks Secrets to GitHub, Apiiro Finds 2,539","summary":"Apiiro found that when Claude Code users pick \"Don't show again\" to allow a command, the command's contents, including any passwords, are written into the project's .claude/settings.local.json file. In results published November 5, 2026, the security firm reported 104,185 of those files public on GitHub, 1,122 of them holding 1,379 secrets, and 2,539 secrets confirmed across all sources.","whyItMatters":"The leak comes from a convenience feature working as designed, so the exposure sits in ordinary command text that format-based secret scanners are not built to catch, and Apiiro found 215 of the 1,122 affected files that neither of two detection tools flagged.","webCardHtml":"\u003cp\u003eApiiro\u0026#39;s count of 104,185 public .claude/settings.local.json files on GitHub is the part that matters. The file is meant to stay on the developer\u0026#39;s PC, and Claude Code has a mechanism to keep it out of Git, but that exclusion setting lives on each individual machine and does not follow the project to another PC. Once a file is under Git management, the exclusion alone cannot protect it.\u003c/p\u003e\u003cp\u003eService API tokens were the most common secret type in the public files at 398, with database passwords second at 379. Files of 8KB or larger carried secrets 9.9% of the time. The rest of the 2,539 total came from Git change history, team-shared configuration files, and AI conversation logs.\u003c/p\u003e","blueskyPost":"Claude Code's \"Don't show again\" writes the allowed command, passwords included, into .claude/settings.local.json. Apiiro found 104,185 of those files public on GitHub, so the permission shortcut outlives the session.","twitterPost":"Claude Code's \"Don't show again\" stores the allowed command, passwords included, in .claude/settings.local.json. Apiiro found 104,185 such files public on GitHub.","threadsPost":"Claude Code's \"Don't show again\" is a convenience setting that writes the allowed command, passwords included, into .claude/settings.local.json. Apiiro found 104,185 of those files public on GitHub. The permission shortcut persists in the project, not the session.","newsletterBlurb":"Apiiro reports that Claude Code's \"Don't show again\" option records allowed commands, passwords and all, into .claude/settings.local.json. The firm found 104,185 of those files public on GitHub, with 1,379 secrets in 1,122 of them and 2,539 confirmed across all sources. Two detection tools missed 215 of the affected files.","attributionJson":"[{\"source\":\"GIGAZINE\",\"url\":\"https://gigazine.net/news/20261109-claude-code-leak-secrets/\",\"title\":\"Claude Code's \\\"Don't show again\\\" option may leak passwords, 2,539 secrets found on GitHub\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":5489,"outputTokens":802,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1794195861,"createdAt":"2026-11-09T03:39:59.000Z","publishedAt":"2026-11-09T03:42:26.000Z","updatedAt":"2026-11-09T03:42:26.000Z"},"cluster":{"id":"c_e5ec56270bd96a596b561481","canonicalTitle":"Claude Codeの「次回から表示しない」でパスワードが流出する恐れ、GitHubで2539件の秘密情報が見つかる","representativeArticleId":"a_5486b45569dc4f2a911ffefe","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[\"Claude Code\"],\"studios\":[\"Anthropic\"],\"people\":[],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-11-09T02:43:00.000Z","lastSeenAt":"2026-11-10T07:55:00.000Z","updatedAt":"2026-11-10T08:14:33.000Z"},"attribution":[{"source":"GIGAZINE","url":"https://gigazine.net/news/20261110-claude-opus-nerf/","title":"Claude Opus 5.5の推論能力が11月3日から急激に低下したとの指摘、1400件の利用履歴から変化が判明"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":["Claude Code"],"studios":["Anthropic"],"people":[],"type":"news","domain":"other","is_roundup":false},"keyFacts":["Apiiro published its investigation results on November 5, 2026.","Apiiro found 104,185 .claude/settings.local.json files public on GitHub.","Of those files, 1,122 contained 1,379 secrets.","Service API tokens were the most common secret type at 398, followed by database passwords at 379.","Apiiro confirmed 2,539 secrets in total across all sources, including Git change history and AI conversation logs."],"pageLinks":{"healthSlugs":["claude-code","anthropic"],"storySlugs":[],"entities":[{"slug":"claude-code","supported":0,"disputed":0,"contradicted":0,"unverified":14,"overall":"unverified","story_count":5,"has_dossier":true},{"slug":"anthropic","supported":18,"disputed":0,"contradicted":0,"unverified":39,"overall":"green","story_count":41,"has_dossier":true}],"stories":[],"entitiesOk":true,"storiesOk":true}}