Apiiro finds 2,539 secrets in Claude Code permission files on GitHub

Apiiro researchers found 2,539 real secrets in 1,994 public GitHub repositories, many stored in Claude Code permission files named .claude/settings.local.json. The files can be created when a user selects 'Yes, and don't ask again' for a command that contains a secret. Apiiro says 63 organizations are affected, and one confirmed its key had been live.

How secrets enter the files

Claude Code asks before running shell commands. If a developer chooses 'Yes, and don't ask again,' it stores the exact approved command in .claude/settings.local.json inside the project folder. Because that command may include a database password, cloud key, API token or SSH login copied from local configuration, the secret is written into the file. Claude Code adds the file to the developer's global git ignore list, but not to the repository's own .gitignore, so a later commit can include it. In 539 of the 1,105 repositories with a real secret that Apiiro traced, a commit co-authored by Claude changed the file.

Scale and exposure

GitHub held 104,185 public copies of .claude/settings.local.json in 103,617 repositories. Apiiro found a real secret in 1,122 of those files, holding 1,379 distinct secrets. Of those, 379 were database passwords and 122 were Supabase service-role keys. Apiiro also found 1,160 more secrets in git history, shared settings files and agent chat transcripts. In total, Apiiro counted 2,539 distinct real secrets in 1,994 repositories. The affected cases include a database vendor's cloud API key, a production Azure Postgres password, a Square production token, an OpenAI-format API key, an npm token, and an owner password for a medical-records database. Apiiro also found 43 SSH credentials in the allowlists, including root passwords in sshpass commands. Generic scanners missed many of the secrets: gitleaks flagged 564 of the 1,122 files and TruffleHog flagged 643, while 215 were flagged by neither. Many were passwords inside commands such as PGPASSWORD=, sshpass -p, mysql -p or bearer headers.

What users should do

Apiiro advises developers to untrack the file with git rm --cached .claude/settings.local.json and add it to the repository's own .gitignore if it is tracked. They should rotate every credential the file has ever held, because deletion does not remove it from history, forks or clones. Even if the file was never committed, users should open it and delete every rule containing a secret. Developers should reference secrets as variables such as $DB_URL instead of typing them into commands, and approve patterns such as Bash(npm run:*) rather than literal commands. Security teams should treat agent folders and memory files as secret-bearing, add them to pre-commit and CI scanning, and triage credentials paired with public hosts first.

Sources: apiiro.com