San Francisco — Claude Code Settings Files Leak Secrets on GitHub

Security researchers at Apiiro reported finding thousands of secrets — including database passwords, API tokens, and root logins — sitting in publicly accessible Claude Code settings files on GitHub, according to Ars Technica. The exposures trace to a single approval prompt built into Anthropic's coding assistant.

The mechanism is mundane. When a developer tells Claude Code "Yes, and don't ask again" to approve an automated shell command, the tool stores that choice as a rule inside a local file, .claude/settings.local.json. Apiiro found that the command itself — not just the approval decision — is often written into that file verbatim, including any password, token, or key embedded in the command text.

How many secrets did Apiiro find?

Apiiro's researchers reported locating more than 100,000 instances of Claude Code's local settings file uploaded to public GitHub repositories. Of those, the team estimated roughly 1,100 files — spanning 63 organizations — contained actual secrets such as public API tokens, database credentials, or private keys, Ars Technica reported.

By the numbers

• 100,000+ — settings files found publicly posted on GitHub, per Apiiro
• ~1,100 — files from 63 organizations containing exploitable secrets

The gap between those two figures matters for how the finding should be read: most exposed settings files appear to carry only command patterns, not live credentials. But even a small fraction of 100,000-plus files still produced over a thousand real, usable secrets, the researchers found.

Why does a “don’t ask again” click lead to a leak?

Claude Code is designed to ask permission before running shell commands on a developer's machine. Checking the box to skip future prompts converts that approval into a persistent rule in the local settings file. In many cases, Apiiro and Ars Technica reported, Claude Code writes changes to that file on its own, without explicit user review of what gets saved — meaning a developer who approved one command involving a password may not realize the password itself was logged to disk.

“Looking into what we can do to prevent this,” Claude Code's Boris Cherny wrote in a Hacker News thread over the weekend, adding that the settings files “should pretty much never be checked in” to version control.

Why didn't .gitignore stop this?

Anthropic's own documentation instructs that .claude/settings.local.json be added to a developer's global .gitignore list, which normally keeps a file out of version control across all of a user's projects. The problem, according to Apiiro's analysis, is that the global setting doesn't automatically propagate to every repository. If a project is cloned onto a new machine, or an existing folder is converted into a git repository after the fact, the global exclusion rule isn't guaranteed to apply — and the settings file, secrets intact, can get swept into a commit. Once pushed, the file can live on indefinitely in forks even after the original repository owner deletes it.

What has Anthropic said about a fix?

The underlying behavior was not new news to Anthropic. Ars Technica reported that a bug report flagging the issue dates back to August 2025, with follow-up reports noting that the settings file sometimes wasn't added to .gitignore at all, or that sensitive commands could land in a separate, unprotected file. Those reports were closed without action after 60 days of inactivity, according to the outlet. Cherny's weekend comment is the clearest public signal yet that the team is revisiting the design, though no timeline or specific patch has been described in the sourcing reviewed for this story.

What should developers watch for now?

• Audit any repository for a committed .claude/settings.local.json file before assuming it's private.
• Check forks of affected repositories, since removing a file from the original project does not purge it from copies already made.
• Rotate any credential that ever appeared in an approved shell command, rather than assuming the “don't ask again” prompt kept it local.
• Watch for an official change from Anthropic to how settings files are generated or excluded from git, following Cherny's comments.

The episode underscores a narrower but recurring pattern in AI coding tools: convenience features that quietly persist state to disk can outlive the session in which a user thought they were operating.