Claude Code approvals leave secrets in public GitHub repos
Apiiro found 2,539 credentials in 1,122 public copies of Claude Code’s local settings file on GitHub, including passwords and API keys. One company it notified confirmed an exposed key was live; Apiiro did not test whether the other credentials still work.
When a developer chooses “Yes, and don’t ask again” for a shell command, Claude Code can save that command in `.claude/settings.local.json`. If the command contains a password or key, it is stored in plain text. Claude Code adds the file to that user’s global Git ignore list, not the repository’s own ignore rules, so the protection does not follow the project. A committed file can remain in Git history and forks.
If a developer committed this file, deleting its current copy cannot establish that its secrets are gone: every credential it recorded remains in scope even when absent from the latest checkout. How many of the other exposed credentials are still valid remains unknown.
AI Coding Agents Leak Thousands of Secrets to GitHub
A command in Claude Code inadvertently saves files with credentials and other sensitive data to public Git repos, creating organizational security gaps.