The root issue is not the button, it is that the allowlist stores the full command string, including whatever was in it. We ran into this ourselves: approve `curl -H "Authorization: Bearer sk-..."` once and that token sits in settings.local.json until someone happens to reread the file.

Two rules that stuck for us: secrets go into commands only via env vars ($TOKEN, never the value), and .claude/ lives in the machine-wide global gitignore, not in the repo. With those, "Don't ask again" is fine and a commit has nothing to leak.