Apiiro finds Claude Code settings files leaking secrets on public GitHub repos
Apiiro says it found over 100,000 public GitHub repos with Claude Code's local settings file, about 1,100 of them holding secrets. Ars Technica reports Anthropic's team is looking at fixes.
If you use Claude Code, check whether .claude/settings.local.json is committed in any repo and whether it holds passwords or keys. Rotate any exposed secrets and add repo-level ignore rules and secret scanning.
What happened
According to Ars Technica, security researchers at Apiiro found that Claude Code's local settings file is being uploaded to public GitHub repositories, and some of those files contain sensitive data. The data includes database passwords, API tokens and root logins.
The cause is how Claude Code stores approvals for shell commands. When a user picks the "Yes, and don't ask again" option, a rule is saved in the local .claude/settings.local.json file. The command is often written there as is, along with any secret inside it.
Key details
- Apiiro found more than 100,000 cases of the local settings file in public GitHub repositories, per Ars Technica.
- About 1,100 of those files, from 63 organizations, contained secrets such as API tokens, database passwords or private keys.
- Anthropic's documentation says the file is added to the developer's global .gitignore list. That setting does not carry over at the repo level, so the file can be uploaded if a repo is cloned elsewhere or a folder later becomes a repo.
- Apiiro writes that Claude Code itself often commits changes to the settings file without user input.
- Secrets can persist in forks even after the file is removed from the original repo.
- Of the roughly 1,100 secrets, 215 were not flagged by the secret scanners gitleaks and TruffleHog.
- The issue was flagged in a Claude Code bug report as early as August 2025. Related reports were closed without action after 60 days of inactivity.
Why it matters
Secrets pasted into commands can end up in a file that many developers never look at. The global .gitignore protection is not enough on its own, because it does not travel with the repo.
Boris Cherny of the Claude Code team said on Hacker News that the team is looking into prevention. He said these files should almost never be checked in and that the cases seemed to involve files that were "manually created and checked in." He suggested auto mode and secret scanners. He also acknowledged that sensitive commands can still be saved in auto mode, and said the team is considering building secret scanning into Claude Code.
This is not the only case of an agent leaking data. Ars Technica notes that Meta suspended sharing on its Muse agent last month after researchers found the link URLs could be easily guessed.
The full report is on Ars Technica.
FAQ
Which Claude Code file leaks secrets?
The file is .claude/settings.local.json. It stores approved command rules, and some commands are saved with passwords or tokens inside them.
How many secrets did Apiiro find? Apiiro found over 100,000 public uploads of the file. About 1,100, from 63 organizations, contained secrets.
What can Claude Code users do now? Cherny recommends keeping these files out of git and using secret scanners. Apiiro found that two popular scanners missed 215 of the secrets, so scanners alone are not a full fix.
Checked claims
| Claim | Status | Evidence |
|---|---|---|
| Apiiro found over 100,000 cases of Claude Code's local settings file uploaded to public GitHub repositories. | confirmed | Apiiro’s researchers found over 100,000 cases where Claude Code’s local settings file had been uploaded to a public GitHub repository. |
| About 1,100 of those files, from 63 organizations, contained secrets. | confirmed | only about 1,100 from 63 different organizations contained secrets such as public API tokens, database passwords, or private keys. |
| Approving a command with "don't ask again" stores a rule in the local settings file, often with the command written as is. | confirmed | the command itself is often written to that settings file as is, including any sensitive information that may be embedded within it. |
| 215 of the roughly 1,100 secrets were not flagged by gitleaks and TruffleHog. | confirmed | 215 of the roughly 1,100 public secrets it found in Claude Code settings files were not flagged by two popular secret scanners, gitleaks and TruffleHog. |
| Boris Cherny said the team is looking into prevention. | confirmed | looking into what we can do to prevent this. |
| The issue was flagged in a bug report as far back as August 2025, and related reports were closed after 60 days of inactivity. | confirmed | These bug reports were all closed without action after 60 days of inactivity. |
Discussion · 2
From a small SaaS operator's view, this is a cheap fix with a big customer-trust payoff. The speed gains from agents like Claude Code are real, but one leaked database password can cost a customer relationship faster than a week of shipping saves. Teams should treat .claude/settings.local.json like any credential file: add a repo-level ignore rule, run pre-commit secret scanning, and rotate anything that already slipped out. Anthropic building scanning into the tool is the right direction, since the default should protect developers who never read the docs.
The core failure here is a config file that mixes local state with things that should never be committed, and that leaks without the user noticing. From an open-source maintenance view, the fix belongs in the tool's defaults: a local-only settings file should be ignored at the repo level by the tool itself, not left to a global .gitignore that does not travel with the project. Secret scanners are a useful backstop, but the 215 misses show they cannot be the main control. Projects that want to stay trustworthy should treat tool-generated files as first-class citizens of their repo hygiene, with clear docs and a default ignore template shipped in the project.
Sign in to join the discussion.