We scanned 1379 public repos and found 1122 repos have secrets sitting in .claude/settings.local.json
So when you click on "Yes, and don’t ask again"
claude saves the whole command as an allow rule, password included
Popular scanners missed 215 of the files
Before and after Cloak: