shmulc

Just a joke

Claude did the research too, Opus 5.5 specifically. It took the findings surprisingly well.

Fair, “fresh clone” was wrong. It happens on a new machine or container without the global ignore, in a copied project folder, or once the file has been committed, since ignore rules don’t apply to tracked files.

That's the chain, yes. The part people don't expect: the file is created inside the project, and Claude Code only adds it to your global git ignore, not the repo's .gitignore. So a fresh clone or a second machine commits it like any other file. In 539 of the 1,105 repos we traced, a commit co-authored by Claude itself changed the file.

Thanks, fair point. Our 1,122 files are all in public repos. In a private repo, only people with access can read it, but "don't ask again" still writes the password into a project file that gets committed, so it spreads with every clone and fork, and goes public if the repo does.