Claude Code Settings File Exposes Secrets in 1,122 Public GitHub Copies

Apiiro said its search of public GitHub found 1,122 copies of Claude Code's .claude/settings.local.json that hold at least one secret. The file can save passwords and API keys when developers approve commands with the Yes, and don't ask again option. One company Apiiro notified confirmed its key had been live; the researchers did not test whether all the secrets still work.

How secrets are saved

Claude Code asks before running most shell commands by default, according to its permissions documentation. When a user approves a command and chooses not to be asked again, Claude Code saves an allow rule in .claude/settings.local.json inside the project. Later matching commands run without a prompt. The rule can cover a pattern such as npm test * or one exact command. If the exact command contains a password or token, the secret is saved too, in plain text. Apiiro reproduced the behavior with Opus 5.5 and Fable 5.1.

Claude Code tries to keep the file out of git. Its settings documentation says that the first time it writes the file in a git repository, it adds it to the user's global git excludes. That protection stays in one user's git settings on one computer and does not help a file that was already committed, Apiiro said. Claude Code never adds the file to the project's own .gitignore, so the protection does not travel with the project.

What Apiiro found

Apiiro's search found 104,185 copies of the file in 103,617 public GitHub repositories. About 1.1%, or 1,122 copies, hold at least one secret, and together they hold 1,379 different secrets. More than a third open a database directly, including 379 database passwords. Others include 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. Among the owners are 63 organizations, mostly software companies of all sizes.

As of Monday, every file with a secret was still on its repository's default branch, and in half of those repositories it had been there for at least 217 days. Older versions contain 734 more secrets across 509 repositories that are not in any current copy. Secrets also sit in 298 of 76,011 copies of the shared .claude/settings.json file. Including those, older versions and saved agent chat logs, the total is 2,539 secrets across 1,994 repositories.

What to do

Apiiro recommends searching GitHub organizations for .claude/settings.local.json and .claude/settings.json and checking each repository's git history. The researchers advise rotating every password, token and key the files have ever held before cleaning up. Developers should stop tracking the local file with git rm --cached .claude/settings.local.json and add it to the repository's own .gitignore. They should delete every rule that contains a secret and refer to secrets as variables from a secrets manager, such as $DB_URL. Developers should approve patterns such as Bash(npm run:*) instead of single commands. For security teams, Apiiro recommends treating agent folders and agent memory files as holding secrets and adding them to pre-commit and CI secret scanning.

Common secret scanners miss many of these files. The researchers ran gitleaks and TruffleHog over every copy without verification. Of the 1,122 files with a secret, gitleaks flagged 564 and TruffleHog flagged 643, and neither flagged 215. Most misses are passwords typed inside commands.

Sources: The Hacker News