Claude Code's permission prompt was shipped without anyone measuring it

Of 104,185 public copies of .claude/settings.local.json on GitHub, Apiiro found 1,122 holding a real secret, which is 1.1%. Here is how it gets there. Claude Code proposes a shell command with your database password in it, you choose the option to approve it permanently, and the tool saves the literal command string as a permission rule. The password now sits in a file in your project folder, and the only thing keeping it off GitHub is an entry in your global gitignore.

I expected most of these files to have been committed by developers who ignored a warning. Apiiro’s data points elsewhere. It traced 1,105 repos with a real secret, and in 539 of them, just under half, a commit co-authored by Claude changed the file. The agent’s own commit instructions tell it to leave out .env and credentials.json, and its own settings file is missing from that list.

The design rests on a human reading each command before approving it. Akhawe and Felt measured what happens to that kind of control in 2013: Chrome and Firefox users clicked through about 70% of malware and phishing warnings. Here the secret is one word in a long line, and it arrives after the tenth interruption of the session. Then permanent approval turns a moment of inattention into a stored string that sits in the project for months. The median affected repo had carried its file for 217 days, and 118 repos had carried it for over a year.

The leak also grows with use. One in ten files over 8 KB carries a real secret; for files below 500 bytes it is fewer than one in 500. A security control whose failure rate rises the longer you use the product as intended has a dose-response curve, and I would like to see the vendor’s version of it. Nobody has published one. Apiiro assembled this picture from outside in three days of code search, and I would guess the vendor could do it from inside in an afternoon.

Scanners will not save you either. Of the 1,122 files, gitleaks flagged 564 and TruffleHog 643, and 215 were caught by neither. They hunt for key formats, and a password after PGPASSWORD= looks like any other word.

The best objection is that Anthropic is already on this. Boris Cherny wrote that “Historically Claude Code has not done secret scrubbing” and listed prototypes: auto mode checks and basic secret scanning. Anthropic’s sandboxing post puts the cut in permission prompts at about 84% in internal use. He also argued that the tool gitignores the file, so the exposed copies must have been created by hand and committed. Those are real responses, and I think the sandbox work points the right way. But fewer prompts leave fewer approvals that each carry more weight, and the stored string is still there. The hand-created theory has trouble with the 539 repos where Claude co-authored the commit, spread across models from Sonnet 4.5 to Opus 5.5. Users have also been reporting the mechanism in GitHub issues since August 2025, and Apiiro says none got a reply and three were closed automatically.

Apiiro compared 16 coding agents and confirmed only Claude Code writes the full approved command to a project file by default. That is mildly reassuring for the other fifteen, and it also shows the question can be answered. Each vendor knows how many approvals its users grant, and it can see which of those rules contain something credential-shaped. Whether the file ever reaches a remote is the one number it cannot see directly, and GitHub, which does publish secret-scanning statistics, is better placed to supply it. Publish all three, quarterly, with the method. If the share of persistent approvals containing credentials is tiny, the vendor gets a good chart. If it is not, users deserve to know before the next 2,539 secrets turn up.

Until that happens, run git log --all --oneline -- .claude/settings.local.json in every repo you own today. With a median exposure of 217 days, a hit is probably old, and the password in it needs rotating whatever the repo’s visibility is now.

Prompted by Coding Agents Are Leaking Your Secrets to GitHub, apiiro.com.