Claude Code’s “Don’t Ask Again” Button Leaked 2,539 Secrets to GitHub. Here’s the 10-Minute Audit.

When you approve a command with “don't ask again,” Claude Code saves an allow rule to .claude/settings.local.json in your project. Sometimes that rule is a pattern like npm test *. Often it's the exact command you approved. So if the command was psql postgresql://postgres:hunter2@db.example.supabase.co, the password is now saved in a JSON file in your repo.

Claude Code does try to protect you. The first time it writes the file, it adds it to your global git excludes. But that only applies on your machine. It never adds the file to the project's own .gitignore. Clone the repo on another laptop, run a CI job, or have a collaborator commit, and the file is free to go public.

Look at the secret types again: database passwords, Supabase service-role keys, SSH logins. That's not an enterprise stack. That's the indie stack — a Supabase backend, a VPS, a weekend MVP pushed to a public repo so you can deploy it or show it off.

A Supabase service-role key is the worst one on that list. It bypasses row-level security entirely. Anyone holding it can read, edit or delete every row in your database — every user, every payment record. No security team is going to catch it for you, because you are the security team.

The workflow makes it worse. When you're vibe-coding, you approve dozens of commands an hour, and pasting a connection string straight into the terminal is the fastest way to get unstuck. “Don't ask again” is built for exactly that kind of speed. The leak happens because you used the tool the way it's designed to be used.

Most coverage treats this as a Claude Code bug. It is one, but the bigger lesson applies to every agent you use: the folders your AI tools write to are now as sensitive as your .env file, and almost nobody treats them that way.

.claude/, .cursor/, .gemini/, .specstory/, agent memory files, saved chat logs. They all collect what you typed, including the things you shouldn't have. Apiiro also found secrets in 298 copies of the shared .claude/settings.json and in saved agent conversations.

Your existing safety net doesn't cover this either. Secret scanners look for known key formats like AKIA… or ghp_…. A password in the middle of a psql or ssh command doesn't match any of them, which is why gitleaks and TruffleHog both missed 215 files that held real credentials. Attackers' tools have caught up, though: the Shai-Hulud worm in September 2025 ran TruffleHog on infected machines, and it flagged more than half of these files.

This is the same pattern we've seen with malicious VS Code extensions and the LiteLLM breach. AI tooling sped up how fast we ship, and the security habits around it haven't caught up.

Do these in order. Rotation comes before cleanup on purpose.

Expect Anthropic to ship something soon. Cherny named both options under evaluation: scanning and redacting secrets before they're written, and changing how permissions are stored so sensitive strings never get saved. Other agent vendors will quietly audit their own config files too.

But a fix going forward won't clean up the 2,539 secrets already out there, or the next file format nobody has scanned yet. Agents are becoming the main way solo founders touch production — databases, servers, deploys. Every one of those actions leaves a record somewhere. The founders who stay safe will be the ones who treat those records like credentials, not like settings.