Git

Claude Code's Allow Rule Is the Whole Command, Password Included

Apiiro found 2,539 real secrets in 1,994 public GitHub repos, most of them in .claude/settings.local.json, the file Claude Code writes when you pick "Yes, and don't ask again". On 2.1.319 the rule it saves is the full command string, PGPASSWORD= and bearer header included, with no prefix and no redaction. Claude Code keeps the file out of git with one line in the global excludes file in your home directory, not the repo, so a clone elsewhere stages it with git add -A, and once the file is tracked the exclude does nothing. When the file is already committed, Claude Code notices and prints that it is ignoring the file's allow rules until you trust the workspace, then appends the next approved command, token included, to the same tracked file.