Apiiro finds real secrets in 1,122 public Claude Code settings files on GitHub

What Apiiro found

Apiiro, an application security company, published research on 5 November 2026 about a side effect of how Claude Code remembers permissions. When a developer approves a shell command and picks "Yes, and don't ask again", Claude Code saves the command as an allow rule so it can run in later sessions without a prompt. If the command contained a password or token typed inline, the rule keeps that value as written.

Apiiro searched public GitHub between 1 and 3 November and found 104,185 copies of .claude/settings.local.json across 103,617 repositories. By its classification, 1,122 of those files, about 1.1%, contain at least one real secret, with 1,379 distinct secrets among them. Coverage by The Hacker News and iTnews describes the haul as including database passwords, SSH logins for public servers, cloud and AI service tokens, code hosting and package registry tokens, and AWS keys.

When Apiiro added older versions of the files in git history, the shared .claude/settings.json file and saved agent transcripts, the count rose to 2,539 secrets across 1,994 public repositories. The figures are Apiiro's own and have not been reproduced by a third party. Apiiro did not test whether any credential still worked.

Why a local file ended up public

Anthropic's permissions documentation confirms the mechanism: a permanent "don't ask again" approval for a Bash command is saved to .claude/settings.local.json at the root of the git repository. The settings documentation describes that file as personal and says Claude Code adds it to the user's global git excludes the first time it writes it, so it should stay out of commits.

That protection has gaps. A file created by hand, a repository cloned to a machine with different git settings, or a developer who adds the whole .claude folder on purpose can still publish it. Apiiro also counted secrets in the shared settings.json, which teams are told to commit. The research cites earlier public bug reports on the same behaviour, including an issue from August 2025 that said approved commands with credentials were stored verbatim.

The way developers use the prompt makes the problem easy to trigger. A typical case is a database client, a curl call with a bearer header or an SSH command with a password on the command line. The developer wants the agent to repeat the step without asking every time, so the approval is saved with the full command. The saved rule then sits in a JSON file that looks like ordinary project configuration, which is exactly the kind of file that gets swept into a commit with git add . when the global exclude is missing.

What it means for teams using coding agents

The finding fits a pattern the site has followed this autumn: agent tools turn convenience settings into new places where sensitive data piles up. Last week a bug report showed Claude Code writing account emails into User-Agent headers, and Microsoft said attackers were using ARTEX AI agents to hunt for exposed credentials on GitHub. A leaked key in a public repository can now be found and used within minutes, which shortens the time a team has to react.

The practical advice from Apiiro and the coverage is plain. Search your organisation's repositories for both Claude settings files and their history, rotate any credential found there because deleting the file does not undo the exposure, stop tracking the local file in git, and review saved rules with the /permissions command. Keeping secrets in environment variables means a saved rule refers to the variable name rather than the value.

None of this is a flaw in the model itself, and no vulnerability identifier has been assigned. It is a product design question about what an approval should store, and the same risk applies to any agent tool that keeps a list of trusted commands in a project folder.

What to watch next

Anthropic had not published a response as of 9 November, and the reports reviewed here do not say whether it plans to change how approvals are saved. The coverage does not establish how many affected repository owners have been told, or how many have rotated their keys since. Apiiro sells secrets detection, so its numbers come from a vendor with an interest in the problem. The next signals are a Claude Code changelog entry that touches permission storage, GitHub secret scanning coverage for these files, and any report that one of the exposed keys was abused. More coverage is in the cybersecurity section.

Questions people ask

How did Claude Code leak secrets to GitHub?

Choosing "Yes, and don't ask again" saves the approved command, including any inline password or token, to .claude/settings.local.json. When that file is committed to a public repository, the secret becomes public.

How many secrets did Apiiro find?

1,379 distinct secrets in 1,122 public copies of the file, and 2,539 secrets across 1,994 repositories when git history, shared settings and transcripts are included.

What should Claude Code users do?

Search repositories and history for the Claude settings files, rotate any exposed credential, untrack the local file, remove secret-bearing rules with /permissions and keep secrets in environment variables.

Sources

1. Apiiro research on secrets in Claude Code settings files (Apiiro, 5 Nov 2026)
2. Claude Code's "Don't Ask Again" File Exposes Passwords and Keys in 1,122 Public Copies on GitHub (The Hacker News, 6 Nov 2026)
3. "Don't ask again" in Anthropic's Claude Code leaks developer secrets (iTnews, 6 Nov 2026)
4. Configure permissions (Anthropic, 9 Nov 2026)
5. Settings files and precedence (Anthropic, 9 Nov 2026)