A recent discovery by Apiiro has revealed that Claude Code's "Don't Ask Again" feature has exposed passwords and API keys in 1,122 public GitHub files. This security breach highlights the risks associated with saving sensitive information in project settings files, which can be committed to public repositories. When a user selects "Yes, and don't ask again," Claude Code saves the command, including any secrets, in a file called .claude/settings.local.json. This file can contain passwords, tokens, and other sensitive information, which can be accessed by anyone with access to the repository.
What happened
The breach occurred because Claude Code's "Don't Ask Again" feature saves shell commands, including passwords and API keys, in a project settings file. This file, .claude/settings.local.json, is not automatically added to the project's .gitignore file, allowing it to be committed to public repositories. As a result, 1,122 public GitHub files contain at least one exposed password or API key, with a total of 1,379 different secrets exposed. The affected files include database passwords, SSH logins, GitHub tokens, and AWS keys, among others. Researchers found the exposed secrets by searching public GitHub repositories for copies of the .claude/settings.local.json file. The search found 104,185 copies of the file in 103,617 repositories, with about 1.1% of them containing at least one secret.
Technical analysis
The technical issue at the heart of this breach is the way Claude Code handles shell commands and sensitive information. When a user selects "Yes, and don't ask again," Claude Code saves the command, including any secrets, in the .claude/settings.local.json file. This file is not encrypted, and its contents are stored in plain text. Furthermore, Claude Code does not automatically add the file to the project's .gitignore file, allowing it to be committed to public repositories. This oversight has resulted in the exposure of sensitive information, including passwords and API keys. The mechanism of the breach is straightforward: when a user saves a command with a secret, the secret is stored in the file, which can then be committed to a public repository. Additionally, Claude Code's attempt to keep the file out of git by adding it to the user's global git excludes is insufficient, as this protection only applies to the user's local machine and does not prevent the file from being committed to a public repository.
Why it matters
This security breach matters because it highlights the risks associated with saving sensitive information in project settings files. The exposure of passwords and API keys can have serious consequences, including unauthorized access to databases, servers, and other sensitive systems. The breach also underscores the importance of proper security practices, such as encrypting sensitive information and using secure storage mechanisms. Furthermore, the fact that 63 organizations, including software companies and medical-records databases, have been affected by the breach emphasizes the need for robust security measures to protect sensitive information. The breach also raises concerns about the use of AI-powered tools like Claude Code, which can potentially introduce new security risks if not properly designed and implemented.
The SoftCodeX view
We expect that this breach will lead to increased scrutiny of security practices in the development community. As developers and organizations rely more heavily on AI-powered tools like Claude Code, it is essential to prioritize security and ensure that sensitive information is handled properly. In our view, this breach highlights the need for more robust security measures, including encryption and secure storage mechanisms, to protect sensitive information. We also expect that developers and organizations will need to re-evaluate their use of AI-powered tools and ensure that they are properly configured and secured to prevent similar breaches in the future.
What to do now
To mitigate the risks associated with this breach, developers and organizations should take immediate action. First, they should rotate their secrets by changing every password, token, and key that may have been exposed. Next, they should clean up their repositories by removing any sensitive information that may have been committed. This can be done by deleting the .claude/settings.local.json file and removing any references to it from the repository's history. Additionally, developers and organizations should review their security practices and implement more robust measures to protect sensitive information, including encryption and secure storage mechanisms. They should also consider using tools and services that can help detect and prevent similar breaches in the future. By taking these steps, developers and organizations can reduce the risks associated with this breach and protect their sensitive information.
Frequently asked questions
What is Claude Code's "Don't Ask Again" feature?
Claude Code's "Don't Ask Again" feature allows users to save shell commands, including passwords and API keys, in a project settings file, which can be exposed in public GitHub repositories.
How many public GitHub files contain exposed passwords and API keys?
According to Apiiro's research, 1,122 public GitHub files contain at least one exposed password or API key.
What types of secrets are exposed in the affected files?
The exposed secrets include database passwords, SSH logins, GitHub tokens, and AWS keys, among others.
Loading comments…