Loading page…
The files can preserve entire approved commands, including credentials. Anthropic is exploring safeguards, but ignore rules and secret scanners have left gaps.
Listen to this story
The findings expose a gap between Claude Code’s local permission memory and Git’s repository-level controls: choosing “Yes, and don’t ask again” can save a command containing literal credentials, while the global ignore rule may not protect files in every repository. Apiiro identified 1,379 credentials in 104,185 public settings-file copies, with about 1.1% of copies containing real secrets; a broader search found 2,539 credentials across historical records and other AI coding tools. Researchers did not test the credentials, and Anthropic discussed safeguards without announcing a fix or release date, leaving teams to audit repository history and rotate exposed keys.
Apiiro found secrets in 1,122 public Claude Code settings files across 103,617 GitHub repositories.
The broader search covered 1,994 public repositories and included historical versions and records from other AI coding tools.
One organization confirmed an exposed key was active, but the researchers did not test credentials or establish that attackers used them.
A command approved once can leave a password behind long after it runs. Security company Apiiro found secrets in 1,122 public Claude Code settings files on GitHub. The exposure connects a convenience feature—remembering approved commands—with files developers may publish alongside their code, despite protections intended to keep them private.
When Claude Code asks permission to run a command, choosing “Yes, and don’t ask again” can save the full command in .claude/settings.local.json. Passwords and access keys embedded in that command can be saved with it.
The file is intended to stay local. Anthropic’s documentation says it is added to the developer’s global .gitignore, which tells Git which files to exclude from version control. But that exclusion is not carried at the repository level. Moving a project to another machine, creating a repository later, or already tracking the file can leave it exposed.
Apiiro researchers Shmulik Cohen and Matan Giladi examined 104,185 public copies of the local settings file across 103,617 GitHub repositories. Roughly 1.1% contained what they classified as real secrets, according to VentureBeat. Exposed credentials were associated with 63 organizations, including production database passwords and credentials for an application handling medical records.
Apiiro’s count in the examined public copies of Claude Code’s local settings file.
Across 1,994 public repositories, including historical versions and records from other AI coding tools.
The researchers did not test the credentials or attempt to access affected systems. One organization confirmed an exposed key had been active; that does not establish that attackers used it.
Claude Code lead Boris Cherny suggested the exposed files had been manually created and checked in. Apiiro, by contrast, said Claude Code itself sometimes commits settings-file changes without user input. In his November 7 response, Cherny discussed built-in credential scanning and permission safeguards but announced no specific fix or release date.
Cherny also recommended secret scanners. Those offer an imperfect backstop: Apiiro said gitleaks and TruffleHog missed 215 secrets it identified. Ars Technica traced a related bug report to August 2025; it closed without action after 60 days of inactivity.
Loading discussion...
Join the conversation
Explain where convenience should give way to protection against accidental exposure.
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.