{"id":2198,"date":"2026-11-09T07:20:35","date_gmt":"2026-11-09T00:20:35","guid":{"rendered":"https:\/\/vncybers.vn\/hieu-rui-ro-dont-ask-again-claude-code-lo-bi-mat\/"},"modified":"2026-11-09T07:20:35","modified_gmt":"2026-11-09T00:20:35","slug":"claude-code-dont-ask-again-permission-rules-secret-exposure","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/hieu-rui-ro-dont-ask-again-claude-code-lo-bi-mat\/","title":{"rendered":"Understanding Claude Code \u201cDon\u2019t Ask Again\u201d Risk: When Permission Rules Expose Secrets"},"content":{"rendered":"

Claude Code<\/strong> c\u00f3 th\u1ec3 l\u01b0u quy t\u1eafc cho nh\u1eefng thao t\u00e1c \u0111\u01b0\u1ee3c ng\u01b0\u1eddi d\u00f9ng ch\u1ecdn \u201cYes, and don\u2019t ask again\u201d v\u00e0o t\u1ec7p .claude\/settings.local.json<\/code>. C\u01a1 ch\u1ebf n\u00e0y gi\u00fap gi\u1ea3m s\u1ed1 l\u1ea7n h\u1ecfi quy\u1ec1n, nh\u01b0ng nghi\u00ean c\u1ee9u m\u1edbi c\u1ee7a Apiiro cho th\u1ea5y c\u00e2u l\u1ec7nh \u0111\u01b0\u1ee3c l\u01b0u c\u00f3 th\u1ec3 ch\u1ee9a m\u1eadt kh\u1ea9u, kh\u00f3a API ho\u1eb7c token r\u1ed3i b\u1ecb \u0111\u01b0a l\u00ean kho GitHub c\u00f4ng khai.<\/p>\n

\"Claude
Claude Code's permission dialog can save repository-scoped rules. Source: Claude Code documentation.<\/figcaption><\/figure>\n

What does \u201cDon\u2019t Ask Again\u201d actually store?<\/h2>\n

Theo t\u00e0i li\u1ec7u ch\u00ednh th\u1ee9c, quy\u1ec1n \u0111\u1ecdc th\u01b0\u1eddng kh\u00f4ng c\u1ea7n ph\u00ea duy\u1ec7t trong th\u01b0 m\u1ee5c l\u00e0m vi\u1ec7c, trong khi l\u1ec7nh shell, truy c\u1eadp web v\u00e0 m\u1ed9t s\u1ed1 h\u00e0nh \u0111\u1ed9ng kh\u00e1c c\u00f3 th\u1ec3 y\u00eau c\u1ea7u x\u00e1c nh\u1eadn. V\u1edbi l\u1ec7nh Bash ho\u1eb7c mi\u1ec1n WebFetch, l\u1ef1a ch\u1ecdn kh\u00f4ng h\u1ecfi l\u1ea1i c\u00f3 th\u1ec3 t\u1ea1o quy t\u1eafc t\u1ed3n t\u1ea1i l\u00e2u d\u00e0i theo t\u1eebng repository trong .claude\/settings.local.json<\/code>.<\/p>\n

The problem is not the configuration file itself but the command content placed in a rule. If a developer pastes a secret directly into a command line, the whole string may become persistent plaintext configuration data.<\/p>\n

What scale of exposure did Apiiro find?<\/h2>\n

Apiiro cho bi\u1ebft \u0111\u00e3 kh\u1ea3o s\u00e1t 104.185 b\u1ea3n sao c\u00f4ng khai c\u1ee7a .claude\/settings.local.json<\/code> tr\u00ean 103.617 repository. Nh\u00f3m nghi\u00ean c\u1ee9u t\u00ecm th\u1ea5y 1.122 t\u1ec7p ch\u1ee9a 1.379 b\u00ed m\u1eadt ri\u00eang bi\u1ec7t; khi m\u1edf r\u1ed9ng sang l\u1ecbch s\u1eed commit, c\u1ea5u h\u00ecnh chia s\u1ebb v\u00e0 transcript c\u1ee7a agent, t\u1ed5ng s\u1ed1 \u0111\u01b0\u1ee3c b\u00e1o c\u00e1o t\u0103ng l\u00ean 2.539 b\u00ed m\u1eadt trong 1.994 repository.<\/p>\n

These figures represent data detected as secrets, and Apiiro noted that it did not test whether every credential remained active. Even so, a key that once appeared in Git history should be treated as an incident and rotated.<\/p>\n

Why can a file named \u201clocal\u201d still reach GitHub?<\/h2>\n

The name can imply that the data stays on one machine. In practice, whether a file is committed depends on Git state, ignore rules, user actions, and automation. Project copying, configuration templates, or commands that stage all files can pull local data into a commit.<\/p>\n

The risk can remain after deletion from the latest revision because secrets may persist in older commits, other branches, forks, caches, or synchronized transcripts.<\/p>\n

The risk chain for development teams<\/h2>\n

Depending on its scope, an exposed token may allow access to private source code, cloud services, package registries, CI\/CD systems, or customer data. An attacker with write access could also alter workflows, inject malicious code into builds, or steal additional credentials.<\/p>\n

This is a clear intersection of AI coding assistants, permission management, and secret hygiene. The agent does not necessarily disclose the key by itself; persistent approval turns a convenient command into durable data, and Git amplifies its distribution.<\/p>\n

How to inspect a repository safely<\/h2>\n
    \n
  • T\u00ecm m\u1ecdi b\u1ea3n sao c\u1ee7a .claude\/settings.local.json<\/code> trong c\u00e2y l\u00e0m vi\u1ec7c, nh\u00e1nh, l\u1ecbch s\u1eed commit v\u00e0 c\u00e1c b\u1ea3n fork.<\/li>\n
  • Review Bash rules, URLs, headers, and parameters for tokens, passwords, access keys, or connection strings.<\/li>\n
  • Run secret scanning on developer machines, pre-commit hooks, pull requests, and CI, not only on the default branch.<\/li>\n
  • Check service logs for unusual access involving credentials suspected of exposure.<\/li>\n<\/ul>\n

    If a secret is found, deleting the file is not enough<\/h2>\n

    Revoke or rotate the key first, because rewriting Git history cannot invalidate copies already downloaded. Then remove the data from history where appropriate, notify owners of forks, and determine which resources the credential could access.<\/p>\n

    Treat data that appeared in a public repository as exposed even without observed abuse. High-privilege keys require log investigation, rotation of dependent credentials, and an assessment of lateral movement.<\/p>\n

    Durable prevention measures<\/h2>\n

    Do not place secrets directly in commands that may be saved as rules. Use a secret manager, runtime-provided environment variables, short-lived credentials, and least privilege. Allow rules should be limited to specific tools, commands, and domains, while teams should periodically remove broad or obsolete permissions.<\/p>\n

    Trong repository, b\u1ed5 sung quy t\u1eafc b\u1ecf qua ph\u00f9 h\u1ee3p cho c\u1ea5u h\u00ecnh c\u00e1 nh\u00e2n, nh\u01b0ng kh\u00f4ng coi .gitignore<\/code> l\u00e0 l\u1edbp b\u1ea3o v\u1ec7 duy nh\u1ea5t. Ki\u1ec3m so\u00e1t hi\u1ec7u qu\u1ea3 c\u1ea7n k\u1ebft h\u1ee3p \u0111\u00e0o t\u1ea1o, secret scanning, b\u1ea3o v\u1ec7 nh\u00e1nh, c\u1ea3nh b\u00e1o l\u1ecbch s\u1eed v\u00e0 quy tr\u00ecnh lu\u00e2n chuy\u1ec3n kh\u00f3a nhanh.<\/p>\n

    The broader lesson for AI coding agents<\/h2>\n

    Every \u201cdon\u2019t ask again\u201d decision is a policy change that can outlive one session. Convenient interfaces therefore need observability, narrow scope, and sensitive-data checks before persistence. Enterprises should govern agent configuration and transcripts like source code and operational logs, with classification, retention limits, access control, and leak monitoring.<\/p>\n

    VNCyberS<\/strong> compiled from Apiiro, The Hacker News, and Claude Code documentation<\/em><\/p>","protected":false},"excerpt":{"rendered":"

    Claude Code c\u00f3 th\u1ec3 l\u01b0u quy t\u1eafc cho nh\u1eefng thao t\u00e1c \u0111\u01b0\u1ee3c ng\u01b0\u1eddi d\u00f9ng ch\u1ecdn \u201cYes, and don\u2019t ask again\u201d v\u00e0o t\u1ec7p .claude\/settings.local.json. C\u01a1 ch\u1ebf n\u00e0y gi\u00fap gi\u1ea3m s\u1ed1 l\u1ea7n h\u1ecfi quy\u1ec1n, nh\u01b0ng nghi\u00ean c\u1ee9u m\u1edbi c\u1ee7a Apiiro cho th\u1ea5y c\u00e2u l\u1ec7nh \u0111\u01b0\u1ee3c l\u01b0u c\u00f3 th\u1ec3 ch\u1ee9a m\u1eadt kh\u1ea9u, kh\u00f3a API ho\u1eb7c token r\u1ed3i b\u1ecb […]<\/p>\n","protected":false},"author":2,"featured_media":2197,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[1100,1098,569,757,1096,426,1101,1099,1097],"class_list":["post-2198","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc","tag-ai-coding-agent","tag-api-key","tag-claude-code","tag-devsecops","tag-dont-ask-again","tag-github","tag-quan-ly-bi-mat","tag-secret-scanning","tag-settings-local-json"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2198"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2198\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2197"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}