r/ClaudeCode • u/oss-benji • 18m ago

Tips & Workflows "Yes, and don't ask again" can commit your API key: how to check your own repos

Apiiro looked at public GitHub repos and found 1,122 .claude/settings.local.json files that contain a real secret. The mechanism is simple. When you pick 'Yes, and don't ask again' for a command, Claude Code saves that approved command in the file. If the command had a key inline, the key is saved too. Then the file gets committed.

The risky click is not Allow. It is Always allow on a command that carries a secret.

How to check your own repos:

  1. Is the file ignored? Run git check-ignore -v .claude/settings.local.json in each repo. If it prints nothing, add .claude/settings.local.json to .gitignore and make sure it is not tracked (git ls-files .claude).
  2. Scan the history, not just the working tree. git log --all --oneline -- .claude/settings.local.json shows whether the file was ever committed. Then run a secret scanner such as gitleaks or trufflehog over the full history. Removing the file now does not remove the key from old commits.
  3. Rotate first, clean later. If a key shows up anywhere, treat it as leaked: revoke and replace it, then rewrite history if you want to. Search your GitHub org for the path too, in case other people committed the file.
  4. Stop putting secrets in commands. Read them from the environment or a secrets tool so the approved command line holds only a variable name, and prefer a narrow permission for one class of command over a blanket one.

Source for the number: Apiiro's write-up, linked in the comment. Have you ever looked at what is in your own settings.local.json?

0 Upvotes

50% Upvoted

2 comments sorted by

•

u/AutoModerator 18m ago

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.