The agent proposes a shell command. Then it asks again, and again, until you pick the option that makes it stop asking.
That last click is where the trouble starts. Research published on November 5 by Apiiro's Shmulik Cohen and Matan Giladi shows that when a developer picks "Yes, and don't ask again" in Claude Code, the tool saves the approved command as an allow rule in a project file named .claude/settings.local.json.
It saves the whole command, word for word. If that command had a database password, an API key, or an authorization header typed into it, the secret is now sitting in a config file inside the repo.
Apiiro looked at 104,185 public copies of that file across 103,617 GitHub repositories. It found real secrets in 1,122 of them, about 1.1%.
Those files held 1,379 distinct credentials: 636 provider-format keys and 743 passwords or tokens for public hosts. The list includes 379 database passwords, 122 Supabase service-role keys, 103 Supabase account tokens and 43 SSH credentials.
