So Claude Code has had a pretty rough week on the privacy front, and it’s two separate leaks, not one.
First one: security firm Apiiro went digging through public GitHub and found 1,122 copies of Claude Code’s .claude/settings.local.json file holding real secrets — 2,539 of them across about 2,000 repos. Database passwords, AWS keys, SSH logins, a production Square token, even the owner password of a medical-records database. The cause is painfully mundane: you approve a command that has a password in it, you click “Yes, and don’t ask again,” and Claude Code saves the whole command, secret included, as a permanent allow rule in that file. Then it gets committed like any other file. And deleting it doesn’t help — git history and forks keep the old copies around. A bug report about this exact behavior was filed back in August 2025, and it got auto-closed by a bot.
Then, separately, a GitHub issue blew up on Hacker News this week (1,500+ points, 500 comments) because Claude Code was putting your signed-in account email into the User-Agent header of web requests it made. So sites it hit during a task just got your real inbox. Anthropic says the email was in the model’s context on purpose — to stop it inventing fake @author tags — and they’ve shipped a guard in 2.1.317 and say the email leaves context entirely in a release early next week. But the fix as shipped mostly asks before sending, it doesn’t block, and it doesn’t cover MCP tools.
What gets me is that neither of these is the model doing something clever or evil. It’s the plumbing around it — a settings file nobody thinks about, a header nobody checks. The most popular coding agent in the world, and the leaks are coming from the boring parts.
Anyway, if you use Claude Code: go check your repos for .claude/settings.local.json right now, and rotate anything that was ever in one. Seriously. Have any of you actually done that check yet, or are we all just assuming we’re fine?
Source: Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
