[{"data":1,"prerenderedAt":35},["ShallowReactive",2],{"post-data-claude-code-settings-local-json-secrets":3},{"post":4,"relatedPosts":19},{"id":5,"title":6,"content":7,"hashtags":8,"coverImage":15,"createdAt":16,"seoTitle":17,"seoDescription":18},"w0eGSX4e6f9ElbwDw0Uf","Passwords in .claude\u002Fsettings.local.json: Find, Rotate, Prevent","\u003Cdiv class=\"container\">\n\u003Cp>\u003Cstrong>Short answer:\u003C\u002Fstrong> when you click \"Yes, and don't ask again\" on a Claude Code command, the approval is saved as a rule in \u003Ccode>.claude\u002Fsettings.local.json\u003C\u002Fcode>. If the command contained a password, the rule can contain it too. The file is meant to stay on your machine, but in early November 2026 Apiiro reported more than 100,000 public copies on GitHub, some holding passwords and tokens. To check your own exposure, search every repository and clone for the file. Treat each credential found as leaked and rotate it first; then untrack the file, add a repository-level ignore rule, and scrub history if needed.\u003C\u002Fp>\n\u003Cp>This guide is for engineers and security owners whose teams use Claude Code. It covers the audit and the fix for this one file and links to our other guides for general cleanup.\u003C\u002Fp>\n\u003Ch2>What was reported, and what is confirmed?\u003C\u002Fh2>\n\u003Cp>\u003Cstrong>Short answer:\u003C\u002Fstrong> the numbers come from Apiiro, a security vendor, and we could read them only in press coverage because Apiiro's own post returned an access error when we tried it. Treat them as a credible signal; they are not audited facts.\u003C\u002Fp>\n\u003Cp>According to Apiiro, as reported by \u003Ca href=\"https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fclaude-codes-dont-ask-again-file.html\">The Hacker News\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fwww.itnews.com.au\u002Fnews\u002Fdont-ask-again-in-anthropics-claude-code-leaks-developer-secrets-630203\">iTnews\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fgbhackers.com\u002Fanthropic-claude-codes-dont-ask-again-feature-exposes-2539-secrets-on-github\">GBHackers\u003C\u002Fa>:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>104,185 copies of \u003Ccode>.claude\u002Fsettings.local.json\u003C\u002Fcode> in 103,617 public repositories.\u003C\u002Fli>\n\u003Cli>1,122 of those files held at least one secret, 1,379 distinct secrets in all. The reported types include 379 database passwords, 43 SSH logins, 42 GitHub, GitLab or npm tokens and 23 AWS keys.\u003C\u002Fli>\n\u003Cli>Counting older file versions, the shared \u003Ccode>settings.json\u003C\u002Fcode>, history and saved transcripts, the total rises to 2,539 secrets in 1,994 repositories.\u003C\u002Fli>\n\u003Cli>Gitleaks flagged 564 files and TruffleHog 643; 215 files were flagged by neither, according to \u003Ca href=\"https:\u002F\u002Fdev.to\u002Fgabrielanhaia\u002Fclaude-codes-dont-ask-again-saved-secrets-in-1122-public-files-215-beat-both-scanners-2pi4\">a write-up on DEV\u003C\u002Fa> that also notes both scanners ran without verification.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Read these with the caveats \u003Ca href=\"https:\u002F\u002Fitwire.com\u002Fbusiness-it-news\u002Fsecurity\u002Fclaude-code-approval-files-found-exposing-company-secrets-on-github-says-apirro-researchers\">iTWire\u003C\u002Fa> raises. An AI reviewer was part of Apiiro's process, Apiiro did not test whether the credentials still work, and an exposed credential is not a proven breach.\u003C\u002Fp>\n\u003Cp>Anthropic's side is on record in a \u003Ca href=\"https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=50407882\">Hacker News thread\u003C\u002Fa>. Boris Cherny of Anthropic wrote on November 7: \"We automatically gitignore it when Claude creates the file, so in this case the files were manually created and checked in.\" In another comment he said the team is thinking through what to improve.\u003C\u002Fp>\n\u003Cp>You do not have to settle that dispute to act. The next sections show why a protection that works on one laptop does not cover a repository.\u003C\u002Fp>\n\u003Ch2>How does a password end up in settings.local.json?\u003C\u002Fh2>\n\u003Cp>\u003Cstrong>Short answer:\u003C\u002Fstrong> you approve a command that has the password typed into it, and Claude Code saves that command as an allow rule.\u003C\u002Fp>\n\u003Cp>The \u003Ca href=\"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fsettings\">settings documentation\u003C\u002Fa> says the file is created \"the first time you give a standing approval on a permission prompt, such as 'Yes, and don't ask again' for a Bash command.\" The \u003Ca href=\"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fpermissions\">permissions documentation\u003C\u002Fa> adds that a rule without \u003Ccode>*\u003C\u002Fcode> \"matches one exact command\". An exact command that begins with \u003Ccode>PGPASSWORD=...\u003C\u002Fcode> is therefore a rule that contains the password. The docs describe the exact-match behavior. That credentials are stored verbatim is shown by Apiiro's findings and by a \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fclaude-code\u002Fissues\u002F5544\">bug report from August 2025\u003C\u002Fa>. It was closed automatically for inactivity without a maintainer reply.\u003C\u002Fp>\n\u003Cp>A rule in the file looks like this (fake values):\u003C\u002Fp>\n\u003Cpre>\u003Ccode>{\n  \"permissions\": {\n    \"allow\": [\n      \"Bash(PGPASSWORD=FAKEpass123 psql -h db.example.com -U app -c \"select 1\")\"\n    ]\n  }\n}\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Two facts about protection matter here:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>The ignore rule is local to a machine.\u003C\u002Fstrong> The docs say Claude Code adds \u003Ccode>**\u002F.claude\u002Fsettings.local.json\u003C\u002Fcode> to your global git excludes file the first time it writes the file in a repository that does not already ignore it. That is \u003Ccode>core.excludesFile\u003C\u002Fcode>, or \u003Ccode>~\u002F.config\u002Fgit\u002Fignore\u003C\u002Fcode> by default. A teammate's clone, a CI checkout and a second laptop do not have that entry. If someone creates the file by hand, the docs say to add it to \u003Ccode>.gitignore\u003C\u002Fcode> yourself.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Ignore rules do not apply to files git already tracks.\u003C\u002Fstrong> The \u003Ca href=\"https:\u002F\u002Fgit-scm.com\u002Fdocs\u002Fgitignore\">gitignore documentation\u003C\u002Fa> says so directly.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>We reproduced the git side with git 2.47.3 on a scratch repository. With the global exclude set, \u003Ccode>git check-ignore -v\u003C\u002Fcode> reported the file as ignored. After \u003Ccode>git add -f\u003C\u002Fcode> the file was tracked and \u003Ccode>git check-ignore\u003C\u002Fcode> returned exit code 1, meaning not ignored. A fresh clone with no global exclude listed the file in \u003Ccode>git ls-files\u003C\u002Fcode>. We did not run Claude Code itself for this test, so it shows how git behaves and says nothing about how often Claude Code produces the situation.\u003C\u002Fp>\n\u003Cp>Two details affect the audit. Before v2.1.211, per the docs, the file lived in the directory where Claude Code started, and newer versions still read an old file left there. So look for the file in subdirectories, not only at the repository root. The VS Code approval card can also save a rule to the project's shared \u003Ccode>.claude\u002Fsettings.json\u003C\u002Fcode>, which is meant to be committed; Apiiro reported that 298 of 76,011 public copies of that file held a secret (figure via DEV).\u003C\u002Fp>\n\u003Ch2>Why did scanners miss some of them?\u003C\u002Fh2>\n\u003Cp>\u003Cstrong>Short answer:\u003C\u002Fstrong> many scanners look for known key formats, and a database password after \u003Ccode>PGPASSWORD=\u003C\u002Fcode> has no recognizable prefix.\u003C\u002Fp>\n\u003Cp>The \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fgitleaks\u002Fgitleaks\">Gitleaks README\u003C\u002Fa> describes rules built from a regular expression, optional keywords and an optional entropy threshold. A rule written for AWS or GitHub key formats will not match \u003Ccode>sshpass -p 'Fake!pw9'\u003C\u002Fcode>. The \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Ftrufflesecurity\u002Ftrufflehog\">TruffleHog README\u003C\u002Fa> describes verification of findings and the \u003Ccode>--results=verified\u003C\u002Fcode> filter. If you filter to verified results only, a password with no verifier to check it is hidden. That second point is our inference from the README, not a documented behavior for this case.\u003C\u002Fp>\n\u003Cp>Neither tool is a failure here. They are tuned to avoid noise, and this file hides secrets inside command strings. For a comparison of the two on a seeded repository, see our \u003Ca href=\"https:\u002F\u002Fennote.io\u002Fblog\u002Fgitleaks-vs-trufflehog-vs-betterleaks\">Gitleaks vs TruffleHog vs Betterleaks test\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch2>How do you find the files in your organization?\u003C\u002Fh2>\n\u003Cp>\u003Cstrong>Short answer:\u003C\u002Fstrong> search three places - the hosting platform's code search, every local clone, and history - because each one misses something.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>1. Code search on GitHub.\u003C\u002Fstrong> The \u003Ca href=\"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fsearch-github\u002Fgithub-code-search\u002Fabout-github-code-search\">code search documentation\u003C\u002Fa> says it covers the default branch only, requires you to be logged in, and excludes files over 350 KiB. The \u003Ca href=\"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fsearch-github\u002Fgithub-code-search\u002Funderstanding-github-code-search-syntax\">syntax page\u003C\u002Fa> documents the \u003Ccode>org:\u003C\u002Fcode> and \u003Ccode>path:\u003C\u002Fcode> qualifiers, so these queries are the place to start (not run here, because they need a GitHub login):\u003C\u002Fp>\n\u003Cpre>\u003Ccode>org:YOURORG path:.claude\u002Fsettings.local.json\norg:YOURORG path:.claude\u002Fsettings.json \"Bash(\"\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>With the GitHub CLI, the \u003Ca href=\"https:\u002F\u002Fcli.github.com\u002Fmanual\u002Fgh_search_code\">manual\u003C\u002Fa> lists \u003Ccode>--owner\u003C\u002Fcode>, \u003Ccode>--filename\u003C\u002Fcode>, \u003Ccode>--limit\u003C\u002Fcode> and \u003Ccode>--json\u003C\u002Fcode>; it warns that results might not match github.com:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>gh search code --owner YOURORG --filename settings.local.json -L 1000 --json repository,path,url\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>No hit is not proof of a clean organization. Code search skips other branches, large files and history, and we did not verify how it treats forks.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>2. Local clones.\u003C\u002Fstrong> In each clone, list tracked copies in any directory:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>git ls-files '*.claude\u002Fsettings.local.json' '*.claude\u002Fsettings.json'\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>\u003Cstrong>3. History.\u003C\u002Fstrong> A file deleted last month is still in history:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>git log --all --full-history --oneline -- '*.claude\u002Fsettings.local.json'\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>One pitfall from our test: the pathspec \u003Ccode>'**\u002F.claude\u002Fsettings.local.json'\u003C\u002Fcode> did not match the file at the repository root, so the log missed the commit that added it. A pattern starting with \u003Ccode>*.claude\u002F...\u003C\u002Fcode>, or \u003Ccode>':(glob)**\u002F.claude\u002Fsettings.local.json'\u003C\u002Fcode>, matched both the root file and one in a subdirectory.\u003C\u002Fp>\n\u003Cp>To see whether a path is ignored even though it is tracked, add \u003Ccode>--no-index\u003C\u002Fcode>: \u003Ccode>git check-ignore -v --no-index .claude\u002Fsettings.local.json\u003C\u002Fcode> prints the source file and line of the matching rule.\u003C\u002Fp>\n\u003Cp>Then triage. Open each file and read the \u003Ccode>allow\u003C\u002Fcode> entries. Anything with an inline assignment such as \u003Ccode>PGPASSWORD=\u003C\u002Fcode>, a \u003Ccode>-p\u003C\u002Fcode> password flag, a bearer token or a URL with credentials is a finding. Rules that only name a command, such as \u003Ccode>Bash(npm test *)\u003C\u002Fcode>, are not.\u003C\u002Fp>\n\u003Ch2>What do you do first when you find one?\u003C\u002Fh2>\n\u003Cp>\u003Cstrong>Short answer:\u003C\u002Fstrong> rotate the credential, then clean up. Apiiro's advice, as reported by iTnews, is the same order: rotate every credential the file ever held before cleaning up.\u003C\u002Fp>\n\u003Col>\n\u003Cli>\u003Cstrong>Rotate.\u003C\u002Fstrong> Change the password or revoke the token at its source and update whatever uses it. Removing the file does not revoke anything: the value may live on in history, forks and clones. Our \u003Ca href=\"https:\u002F\u002Fennote.io\u002Fblog\u002Fleaked-openai-or-anthropic-api-key-what-to-do-in-the-first-hour\">first-hour guide for leaked API keys\u003C\u002Fa> covers the order of actions for keys; the same logic applies to a database or SSH password.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Check use.\u003C\u002Fstrong> Look at the service's own logs for logins from unfamiliar places in the window since the commit. For a private repository the exposure is narrower, but everyone with access to the repository can read it.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Stop tracking.\u003C\u002Fstrong> The \u003Ca href=\"https:\u002F\u002Fgit-scm.com\u002Fdocs\u002Fgit-rm\">git rm documentation\u003C\u002Fa> describes \u003Ccode>--cached\u003C\u002Fcode> as removing paths only from the index and leaving working tree files alone:\n\u003Cpre>\u003Ccode>git rm --cached .claude\u002Fsettings.local.json\necho '.claude\u002Fsettings.local.json' >> .gitignore\ngit add .gitignore\ngit commit -m \"Stop tracking Claude Code local settings\"\u003C\u002Fcode>\u003C\u002Fpre>\n\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Scrub history, if you must.\u003C\u002Fstrong> In our test, after \u003Ccode>git rm --cached\u003C\u002Fcode> the password was still reachable: \u003Ccode>git log --all -S'PGPASSWORD='\u003C\u002Fcode> found the original commit and \u003Ccode>git show <commit>:.claude\u002Fsettings.local.json\u003C\u002Fcode> printed it. Rewriting history is destructive: back up first, coordinate with teammates, and expect a force-push. It is covered step by step in \u003Ca href=\"https:\u002F\u002Fennote.io\u002Fblog\u002Fremove-secret-from-git-history\">Remove a secret from git history and verify the result\u003C\u002Fa>. Treat it as hygiene; a rewrite does not undo a leak that has already been copied.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>If Claude Code opens a project where the file is tracked, the docs say it treats the file as repository-supplied and holds its rules until you trust the folder. That is a useful brake, but it does not replace removing the file.\u003C\u002Fp>\n\u003Ch2>How do you stop it from happening again?\u003C\u002Fh2>\n\u003Cp>\u003Cstrong>Short answer:\u003C\u002Fstrong> use four layers - a repository ignore rule, approvals that do not contain secrets, an organization-level policy, and a scanner that looks inside the file.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Ignore rule in the repository.\u003C\u002Fstrong> Add \u003Ccode>.claude\u002Fsettings.local.json\u003C\u002Fcode> to the repository's \u003Ccode>.gitignore\u003C\u002Fcode> and commit that change. Unlike the global exclude, it travels with every clone. Add the same line to your project template so that new repositories start with it.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Approvals without secrets.\u003C\u002Fstrong> Approve command patterns instead of literal commands. The permissions docs show the prompt \"Yes, and don't ask again for: npm test *\" for prefix commands. A command with a literal password cannot sensibly be generalized, so decline the standing approval and keep the credential out of the command:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>PGPASSWORD=\"$DB_PASSWORD\" psql -h db.example.com -U app\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Here the rule text contains only the variable name. One related caveat: the docs say a rule does not match past an assignment of a variable it does not recognize as safe, so expect a prompt for such commands. Review what has already been saved with \u003Ccode>\u002Fpermissions\u003C\u002Fcode>, which, per the docs, lists every rule and the file it comes from.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Organization policy.\u003C\u002Fstrong> Claude Code reads managed settings from a system path, such as \u003Ccode>\u002Fetc\u002Fclaude-code\u002Fmanaged-settings.json\u003C\u002Fcode> on Linux. The docs say permission lists merge across scopes \"unless your organization sets \u003Ccode>allowManagedPermissionRulesOnly\u003C\u002Fcode>\". The \u003Ca href=\"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fmanaged-settings\">managed settings page\u003C\u002Fa> says this key makes Claude Code \"ignore permission rules from user, project, and local files\". Test it on one machine before rolling it out. We found no managed setting that scrubs secrets from saved rules.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>A scanner rule for this file.\u003C\u002Fstrong> A custom Gitleaks rule can target the file by path. The rule syntax below follows the Gitleaks README; we did not run it in Gitleaks. We tested the regular expression alone in Python against a fake settings file, using only constructs that Go's regex engine also supports:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>[extend]\nuseDefault = true\n\n[[rules]]\nid = \"claude-settings-inline-credential\"\ndescription = \"Credential typed into a Claude Code permission rule\"\npath = '''\\.claude\u002Fsettings(\\.local)?\\.json$'''\nregex = '''(?i)(PGPASSWORD=[^\\s\"'$\\]\\S*|sshpass\\s+-p\\s*\\S+|\\s-p[^\\s]{3,}|bearer\\s+[A-Za-z0-9._~+\u002F-]{16,}|:\u002F\u002F[^\u002F\\s:@]+:[^\u002F\\s@]+@)'''\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>On eleven fake rules the expression matched the five that held a literal password, token or URL credential, missed the env-var reference \u003Ccode>PGPASSWORD=\"$DB_PASSWORD\"\u003C\u002Fcode> as intended, and produced one false positive on \u003Ccode>npm run -prefix app build\u003C\u002Fcode>. Expect noise and tune it. The simplest alternative is a path-only rule that fails any commit containing the file, since the file should never be committed. Pre-commit hooks can be skipped, as the Gitleaks README notes for \u003Ccode>SKIP=gitleaks\u003C\u002Fcode>, so run the same check in CI. GitHub's \u003Ca href=\"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcode-security\u002Fsecret-scanning\u002Fusing-advanced-secret-scanning-and-push-protection-features\u002Fcustom-patterns\u002Fdefining-custom-patterns-for-secret-scanning\">custom patterns\u003C\u002Fa> can do the content part on push; we did not verify whether they can be limited to a path.\u003C\u002Fp>\n\u003Ch2>Where should the password live instead?\u003C\u002Fh2>\n\u003Cp>\u003Cstrong>Short answer:\u003C\u002Fstrong> in a secrets manager that injects it at run time, so the value does not have to appear in a command, a file or a settings rule.\u003C\u002Fp>\n\u003Cp>Settings files, shell history and chat logs are all places where a typed password gets copied. The Ennote CLI is documented to \"fetch, inject, and manage enterprise secrets without writing plaintext .env files to disk\", with the pattern \u003Ccode>ennote secret get <secret-name> -- <command>\u003C\u002Fcode>; the quickstart's example is \u003Ccode>ennote secret get stripe-keys -- npm run dev\u003C\u002Fcode>. A database command can then take its password from the manager instead of from the command line. Our guide to \u003Ca href=\"https:\u002F\u002Fennote.io\u002Fblog\u002Fkeep-env-secrets-away-from-claude-code\">keeping .env secrets away from Claude Code\u003C\u002Fa> covers deny rules, the sandbox and environment scrubbing, and the guide to \u003Ca href=\"https:\u002F\u002Fennote.io\u002Fblog\u002Fmcp-server-api-keys-claude-code\">MCP server API keys\u003C\u002Fa> covers where to keep keys that MCP servers need, in \u003Ccode>.mcp.json\u003C\u002Fcode> and elsewhere.\u003C\u002Fp>\n\u003Cp>One caution that applies to any tool of this kind: a secret handed to a process has to live somewhere in that process, commonly its environment, and a command the agent launches may inherit it. This is general behavior that the Ennote docs do not state, so check how your tool passes values and give the agent test credentials where you can.\u003C\u002Fp>\n\u003Ch2>What is still unknown?\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Real impact.\u003C\u002Fstrong> Nobody has shown how many of the reported credentials were live, and one company was reported to have confirmed a live key.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Cause in each repository.\u003C\u002Fstrong> Anthropic says the files were created by hand and committed. Apiiro found Claude co-authored commits touching the file in 539 of 1,105 traced repositories, which shows Claude-era commits and leaves open why the file was tracked. We take no side; the protection gap is the same.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Future behavior.\u003C\u002Fstrong> Anthropic said it is looking at improvements. Re-read the settings documentation before relying on any behavior described here, since it may change.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Sources\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>Reports on the Apiiro research, opened November 9, 2026: \u003Ca href=\"https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fclaude-codes-dont-ask-again-file.html\">The Hacker News\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fwww.itnews.com.au\u002Fnews\u002Fdont-ask-again-in-anthropics-claude-code-leaks-developer-secrets-630203\">iTnews\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fitwire.com\u002Fbusiness-it-news\u002Fsecurity\u002Fclaude-code-approval-files-found-exposing-company-secrets-on-github-says-apirro-researchers\">iTWire\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fgbhackers.com\u002Fanthropic-claude-codes-dont-ask-again-feature-exposes-2539-secrets-on-github\">GBHackers\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fdev.to\u002Fgabrielanhaia\u002Fclaude-codes-dont-ask-again-saved-secrets-in-1122-public-files-215-beat-both-scanners-2pi4\">DEV\u003C\u002Fa>. The original Apiiro post was not readable.\u003C\u002Fli>\n\u003Cli>Anthropic: \u003Ca href=\"https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=50407882\">Hacker News discussion\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fclaude-code\u002Fissues\u002F5544\">issue 5544\u003C\u002Fa>, Claude Code docs: \u003Ca href=\"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fsettings\">Settings\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fpermissions\">Permissions\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fmanaged-settings\">Managed settings\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>GitHub: \u003Ca href=\"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fsearch-github\u002Fgithub-code-search\u002Fabout-github-code-search\">About code search\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fsearch-github\u002Fgithub-code-search\u002Funderstanding-github-code-search-syntax\">Code search syntax\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fcli.github.com\u002Fmanual\u002Fgh_search_code\">gh search code\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcode-security\u002Fsecret-scanning\u002Fusing-advanced-secret-scanning-and-push-protection-features\u002Fcustom-patterns\u002Fdefining-custom-patterns-for-secret-scanning\">Custom patterns\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Git: \u003Ca href=\"https:\u002F\u002Fgit-scm.com\u002Fdocs\u002Fgitignore\">gitignore\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fgit-scm.com\u002Fdocs\u002Fgit-rm\">git rm\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fgit-scm.com\u002Fdocs\u002Fgit-check-ignore\">git check-ignore\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fgit-scm.com\u002Fdocs\u002Fgit-log\">git log\u003C\u002Fa>. Scanners: \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fgitleaks\u002Fgitleaks\">Gitleaks\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Ftrufflesecurity\u002Ftrufflehog\">TruffleHog\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Ennote: \u003Ca href=\"https:\u002F\u002Fdocs.ennote.io\u002Fcli\u002Foverview\">CLI overview\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fdocs.ennote.io\u002Fcli\u002Fquickstart\">CLI quickstart\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Chr>\n\u003Cp>\u003Cstrong>Keep passwords out of your commands and repositories.\u003C\u002Fstrong> Ennote is a secret manager for passwords, API keys and environment variables, with role-based access, an audit log and sync to Kubernetes. \u003Ca href=\"https:\u002F\u002Fapp.ennote.io\u002F?utm_source=blog&utm_medium=article&utm_campaign=claude-code-settings-local-json-secrets&utm_content=footer\">Start for free\u003C\u002Fa> on the Developer plan; limits on users and secrets apply.\u003C\u002Fp>\n\u003C\u002Fdiv>",[9,10,11,12,13,14],"ClaudeCode","SecretManagement","DevSecOps","GitHub","ZeroPersistence","CyberSecurity","https:\u002F\u002Ffirebasestorage.googleapis.com\u002Fv0\u002Fb\u002Fblog-01-c712e.firebasestorage.app\u002Fo\u002Fblog-covers%2F1794271549382_Gemini_Generated_Image_agi0ybagi0ybagi0.jpeg?alt=media&token=fb7bde39-7306-4d8c-ac3f-2d336304d978",1794271550557,"Claude settings.local.json Secrets: Find, Rotate, Prevent","Claude Code's 'don't ask again' feature can save passwords in settings.local.json. Find exposed files, rotate secrets, and prevent future leaks",[20,25,30],{"title":21,"slug":22,"coverImage":23,"createdAt":24},"The Evolution of Kubernetes Secret Delivery (And Why Polling is Dead)","the-evolution-of-kubernetes-secret-delivery-and-why-polling-is-dead","https:\u002F\u002Ffirebasestorage.googleapis.com\u002Fv0\u002Fb\u002Fblog-01-c712e.firebasestorage.app\u002Fo\u002Fblog-covers%2F1777523487463_diagramm%20(2).jpg?alt=media&token=5b01f974-cfe5-4890-b68f-5e178b422c6e",1777523490608,{"title":26,"slug":27,"coverImage":28,"createdAt":29},"mSecure Password Manager Incident: What Is Confirmed and What to Reset First","msecure-breach-what-to-do","https:\u002F\u002Ffirebasestorage.googleapis.com\u002Fv0\u002Fb\u002Fblog-01-c712e.firebasestorage.app\u002Fo\u002Fblog-covers%2F1793932710332_Gemini_Generated_Image_r7yeg4r7yeg4r7ye.jpeg?alt=media&token=f42c9c4d-8c71-4615-9a80-97f67b94bdea",1793903987316,{"title":31,"slug":32,"coverImage":33,"createdAt":34},"Platform Breach: How to Rotate All Your Environment Variables","rotate-environment-variables-after-platform-breach","https:\u002F\u002Ffirebasestorage.googleapis.com\u002Fv0\u002Fb\u002Fblog-01-c712e.firebasestorage.app\u002Fo\u002Fblog-covers%2F1793652683825_Gemini_Generated_Image_oj1iemoj1iemoj1i.jpeg?alt=media&token=41e54608-2ae0-40d9-acd8-192d54c0f1c9",1793652685659,1794271722159]