Claude Code's 'Don't Ask Again' File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Security firm Apiiro reports that 1,122 of about 104,000 public copies of Claude Code's .claude/settings.local.json on GitHub contain secrets, including database passwords and AWS keys. The file can store approved commands verbatim, and Claude Code excludes it only in the user's global git settings, not the project's .gitignore. Apiiro did not test whether the credentials work, and its figures could not be independently verified. Anthropic's Boris Cherny says the files were committed manually and that secret scrubbing is under study. Rotate exposed credentials before deleting the file.
Why it ranked
No. 1 of 46 with a score of 0.74. The panel rated it highest on practical relevance (0.89) and new information (0.88), lowest on technical depth (0.62).
- AI judgeJudge 2claude-haiku-5-5
- Widely relevant security leak of secrets via an AI coding agent's settings file, backed by a sizable scan of public repos and vendor response; actionable for builders but mostly a news report.
- AI judgeJudge 3gpt-5.6-luna
- A well-documented, actionable secret-exposure incident affecting Claude Code users, with substantial prevalence data, concrete credential types, remediation advice, and vendor response. It is highly relevant to AI-assisted development and software security, though technically not deeply reproducible.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.74total under rubric v2.3
- Significance0.64
- Reader interest0.88
- Audience breadth0.62
- Practical relevance0.89
- Substantiated0.76
- Technical depth0.62
- New information0.88
- Counts against: Promotional0.03
- Counts against: Overclaim0.22
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.71 | 0.50 | 0.72 | 0.64 | 0.22 | +0.24 | +0.154 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.87 | 0.85 | 0.91 | 0.88 | 0.06 | +0.26 | +0.228 |
| Audience breadthHow many people who build technology does it concern? | 0.51 | 0.67 | 0.68 | 0.62 | 0.17 | +0.13 | +0.081 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.91 | 0.90 | 0.86 | 0.89 | 0.04 | +0.22 | +0.195 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.75 | 0.70 | 0.82 | 0.76 | 0.12 | +0.05 | +0.038 |
| Technical depthHow technically substantive is it? | 0.75 | 0.55 | 0.55 | 0.62 | 0.20 | +0.05 | +0.031 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.82 | 0.85 | 0.98 | 0.88 | 0.16 | +0.05 | +0.044 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.03 | 0.02 | 0.03 | 0.03 | −0.19 | −0.006 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.27 | 0.20 | 0.20 | 0.22 | 0.07 | −0.11 | −0.025 |
| Sum of contributions | +0.740 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.740 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-09/1/"><img src="https://rubric.hrih.si/badge/2026-11-09/1.svg" alt="Ranked #1 on Rubric, 9 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 1 matches source · 7 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
Apiiro said 1,122 public copies of the .claude/settings.local.json file hold at least one secret, though it did not test whether any still work.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Apiiro said that 1,122 public copies of that file hold at least one secret, though it did not test whether any still work”
The source says No passage could be compared.
Source cited by the article: apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again
Couldn’t checkNumber
Apiiro's search of public GitHub found 104,185 copies of the file in 103,617 repositories, with about 1.1% (1,122 copies) holding at least one secret.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Apiiro's search of public GitHub found 104,185 copies of the file in 103,617 repositories”
The source says No passage could be compared.
Source cited by the article: apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again
Couldn’t checkNumber
The 1,122 files together hold 1,379 different secrets, including 379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens and 23 AWS keys.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Together they hold 1,379 different secrets”
The source says No passage could be compared.
Source cited by the article: apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again
Couldn’t checkNumber
In 539 of the 1,105 repositories the researchers traced, a commit listing Claude as a co-author changed the file.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “In 539 of the 1,105 repositories the researchers traced, a commit listing Claude as a co-author changed the file”
The source says No passage could be compared.
Source cited by the article: apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again
Matches sourceCausal conclusion
Claude Code adds the file to the user's global git excludes the first time it writes it in a git repository, but never to the project's own .gitignore.
The cited source says the same thing.
The article says “it adds the file to the user's global git excludes, its settings documentation says”
The source says “The first time Claude Code writes the file in a git repository that doesn’t already ignore it, it adds **/.claude/settings.local.json to your global git excludes file”
Source cited by the article: code.claude.com/docs/en/settings
Couldn’t checkQuote
Boris Cherny said the files were manually created and checked in, since Claude Code automatically gitignores the file when it creates it.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “We automatically gitignore it when Claude creates the file, so in this case the files were manually created and checked in”
The source says No passage could be compared.
Source cited by the article: news.ycombinator.com/item
Couldn’t checkDate
A bug report on the issue filed August 11, 2025 was closed by an automated bot as 'not planned' on January 3 after 60 days without activity.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “An automated bot closed that report as 'not planned' on January 3, after 60 days without activity”
The source says No passage could be compared.
Source cited by the article: github.com/anthropics/claude-code/issues/5544
Couldn’t checkNumber
Three further bug reports were filed, none got a reply from Anthropic, and three were closed automatically as inactive or duplicate.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “None got a reply from Anthropic, and three were closed automatically as inactive or duplicate”
The source says No passage could be compared.
Source cited by the article: github.com/anthropics/claude-code/issues/11982
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 9 Nov 2026, 05:46 UTC. It played no part in the ranking.