Apiiro finds Claude Code settings files leaking secrets on public GitHub repos

What happened

According to Ars Technica, security researchers at Apiiro found that Claude Code's local settings file is being uploaded to public GitHub repositories, and some of those files contain sensitive data. The data includes database passwords, API tokens and root logins.

The cause is how Claude Code stores approvals for shell commands. When a user picks the "Yes, and don't ask again" option, a rule is saved in the local .claude/settings.local.json file. The command is often written there as is, along with any secret inside it.

Key details

• Apiiro found more than 100,000 cases of the local settings file in public GitHub repositories, per Ars Technica.
• About 1,100 of those files, from 63 organizations, contained secrets such as API tokens, database passwords or private keys.
• Anthropic's documentation says the file is added to the developer's global .gitignore list. That setting does not carry over at the repo level, so the file can be uploaded if a repo is cloned elsewhere or a folder later becomes a repo.
• Apiiro writes that Claude Code itself often commits changes to the settings file without user input.
• Secrets can persist in forks even after the file is removed from the original repo.
• Of the roughly 1,100 secrets, 215 were not flagged by the secret scanners gitleaks and TruffleHog.
• The issue was flagged in a Claude Code bug report as early as August 2025. Related reports were closed without action after 60 days of inactivity.

Why it matters

Secrets pasted into commands can end up in a file that many developers never look at. The global .gitignore protection is not enough on its own, because it does not travel with the repo.

Boris Cherny of the Claude Code team said on Hacker News that the team is looking into prevention. He said these files should almost never be checked in and that the cases seemed to involve files that were "manually created and checked in." He suggested auto mode and secret scanners. He also acknowledged that sensitive commands can still be saved in auto mode, and said the team is considering building secret scanning into Claude Code.

This is not the only case of an agent leaking data. Ars Technica notes that Meta suspended sharing on its Muse agent last month after researchers found the link URLs could be easily guessed.

The full report is on Ars Technica.

FAQ

Which Claude Code file leaks secrets? The file is .claude/settings.local.json. It stores approved command rules, and some commands are saved with passwords or tokens inside them.

How many secrets did Apiiro find? Apiiro found over 100,000 public uploads of the file. About 1,100, from 63 organizations, contained secrets.

What can Claude Code users do now? Cherny recommends keeping these files out of git and using secret scanners. Apiiro found that two popular scanners missed 215 of the secrets, so scanners alone are not a full fix.