Apiiro investigated how Claude Code's "Don't Ask Again" approval feature leaked secrets into public GitHub repositories. The feature lets a developer approve a file-write action once, then silently repeat it for every future write in the session. Apiiro found 1,122 public files containing passwords, tokens, and private keys as a result.
The failure lives in the approval design. A developer approves writing one file. The agent treats that as standing permission to write any file, including files the developer never reviewed. No second prompt appears. No warning flags when a sensitive value is about to land on disk and then get pushed to a public repository. The developer who clicked "Don't Ask Again" had no way to know the scope of what they were agreeing to.
The design tension this exposes is familiar: making an agent less interruptive also makes it harder to stop before it does something that cannot be undone. Apiiro's data shows that this is not a theoretical risk. Thousands of developers used the feature; 1,122 public files now hold secrets. Any product team building a "remember this choice" shortcut needs to show the developer the full reach of that choice before they confirm it, and narrow that reach to the specific action, not the whole action type.