Claude Code, Anthropic's coding assistant, asks before it runs a command on your computer. One of the answers it offers is "Yes, and don't ask again". Pick it, and the assistant saves that exact command as a rule in a settings file inside the project. When the command contained a password, the password is now in that file in plain text, and 1,122 such files on public GitHub, the site where developers share code, hold a live secret. Among the secrets are 379 database passwords.
A button that turns one decision into a record
Picture a freelancer who asks the assistant to look at a customer's online shop database. The command it proposes has the database password in the middle of it, because the freelancer pasted it in earlier to fix a connection problem. She clicks the don't-ask-again option so she is not interrupted ten more times. Nothing about that moment feels like handing over a password. But the password now exists in two places: her head and a file in the project folder.
Anthropic's documentation says the file is added to a global ignore list on the developer's computer, so it normally stays out of commits. That protection belongs to one machine, not to the project. Where a commit made with Claude's help added the file anyway, which happened in about half of the projects traced, the password went public with everything else. Deleting the file later does not undo it: earlier versions of the file in the project history held another 734 secrets that no current copy contains.
Why the usual alarms stay quiet
GitHub now blocks uploads that contain keys in a known format, and scanning tools do the same on a developer's computer. They are good at spotting a key that looks like a key. A password in the middle of a shell command looks like ordinary text. Of the 1,122 files with a live secret, 215 were flagged by neither of two common scanners, about one in five. The protections built for the last kind of leak are weakest against this one.
The behaviour is not new, since users were reporting it in 2025. What is new is the count, and the count shows how a convenience feature behaves at scale: about one public copy of the file in every hundred holds a secret.
The same thing happens outside coding
Any "always allow" in any assistant stores what you allowed. A finance team that lets an AI assistant always run a payment lookup could be saving an account number or an access key inside that approval. We have already written about how AI conversation logs are becoming a company's password file. Approval lists are the quieter version: shorter, less noticed, and kept in a file whose name nobody has memorised.
What to do with it
If you have ever approved a command with a password in it, change that password first, then clean up the file, because anyone who copied it already has the old one. After that, make the command refer to the password by name, as an environment variable, which is a value stored on the computer outside the command. The saved rule then holds the name and never the secret.