Apiiro builds application security software that maps code changes and flags risks such as exposed secrets, vulnerable dependencies and risky design changes.

What did Apiiro find about Claude Code?

In research published on 5 November 2026, Apiiro said Claude Code's saved permission rules had put real credentials into 1,122 public copies of a local settings file on GitHub.

Apiiro news

Application security company1 story

Apiiro is an application security company that sells tools for finding risk in source code, software supply chains and AI-generated code, including secrets detection.

Abstract illustration of a shield over a network — Apiiro finds real secrets in 1,122 public Claude Code settings files on GitHub

Cybersecurity9 Nov 2026, 07:25 UTC

Apiiro says Claude Code's saved command approvals put 1,379 distinct secrets into 1,122 public settings.local.json files on GitHub, per 5 November research.

Summary

Security firm Apiiro published research on 5 November 2026 showing that Claude Code's "Yes, and don't ask again" approvals can store credentials verbatim in .claude/settings.local.json. Scanning public GitHub between 1 and 3 November, it found 104,185 copies of the file; 1,122 held at least one real secret, 1,379 distinct secrets in all. Counting git history and other Claude files, Apiiro reports 2,539 secrets in 1,994 repositories. Anthropic had not commented publicly.

About Apiiro

Apiiro is an application security company that sells tools for finding risk in source code, software supply chains and AI-generated code, including secrets detection. Its research team published a study in November 2026 showing that Claude Code permission files committed to public GitHub repositories exposed real passwords, tokens and keys.

Reviewed 9 Nov 2026

Official site

Facts at a glance

Type: Application security and code risk platform
Products: Code security tooling including secrets detection source
Claude Code research: 1,122 of 104,185 public .claude/settings.local.json copies held a real secret, published 5 November 2026 source

Questions people ask

What does Apiiro do?: Apiiro builds application security software that maps code changes and flags risks such as exposed secrets, vulnerable dependencies and risky design changes.
What did Apiiro find about Claude Code?: In research published on 5 November 2026, Apiiro said Claude Code's saved permission rules had put real credentials into 1,122 public copies of a local settings file on GitHub.

Apiiro news

Every story about Apiiro

Apiiro finds real secrets in 1,122 public Claude Code settings files on GitHub