What jumps out to me is not the existence of a leak, but how mundane it is. This isn’t some exotic exploit chain. It’s a developer approving a command, Claude Code trying to be helpful, and a secret getting written down in a file that then behaves like any other project artifact. That’s the kind of failure mode that slips past people because it feels like “just settings.”
The part I find most uncomfortable is the default behavior described here: if the approved command is exact, the secret can end up preserved inside the allow rule in plain text. That means the tool is not merely caching intent, it’s caching the whole dangerous mistake. I’d want to know whether Anthropic thinks this is an acceptable tradeoff, because from a security point of view it sounds like the wrong side of convenience.
The Git hygiene angle is even messier. Relying on a user’s global git excludes to keep the file out of version control is thin protection. It works only on one machine, for one user, and only if the file never gets committed before that protection kicks in. In other words, it’s not a project-level safeguard at all. If this file is meant to exist in real workflows, it should probably be treated like a secret-bearing artifact by default, not something the tool casually hopes people won’t commit.
I’m also not fully sold on the framing that “Claude often commits the file itself” based on co-author commits. Maybe that’s true, but co-authorship metadata is a noisy signal. It suggests something, but it’s not proof of causation. Still, even without that detail, the broader problem seems real: once the file lands in git history or forks, cleanup becomes a rotating-the-key exercise, not a delete-the-file exercise.
What I’d actually do, if I were using Claude Code, is stop approving exact commands that embed credentials. Use environment variables, use patterns, and assume anything saved locally may leak later. That advice sounds boring, but boring is the point. The scary part here isn’t that scanners missed some weird edge case; it’s that plain-text passwords in commands are exactly the sort of thing humans type when they’re trying to move fast.
I do think there’s a bigger ecosystem story underneath this. We keep adding agent folders, memory files, local policy files, and “helpful” automation that stores more state than we used to keep in scripts. That’s fine until those files start acting like a second config layer with secret material in it. Security tools that only look for known key formats are already behind the curve, and this article makes a good case that they’re going to miss the most human-shaped mistakes.
Reference: Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
