Claude Code settings files leave secrets exposed in public repositories
Apiiro has identified 1,122 public copies of Claude Code’s .claude/settings.local.json file that contain at least one secret, spanning 1,379 distinct credentials. The files were found across public GitHub repositories and included database passwords, SSH logins, AWS keys, and tokens for GitHub, GitLab, and npm.
The issue stems from Claude Code’s command-approval workflow. When a user chooses “Yes, and don’t ask again,” the tool can record an allow rule in the project settings file. Where the approval covers one exact command rather than a pattern, credentials entered directly on that command line can be stored verbatim in plain text.
Local convenience can become a repository exposure
Claude Code asks for approval before running most shell commands. Its permissions documentation says an approved command is saved so matching commands can run without another prompt in later sessions. Apiiro reproduced the behaviour with the latest models cited in its research, Opus 5.5 and Fable 5.1.
Claude Code attempts to exclude the local settings file by adding it to a user’s global Git excludes when it is first written inside a Git repository. That safeguard applies only to that user’s Git configuration on that computer. It does not protect a file already committed, and the project does not receive a portable .gitignore rule. Apiiro found that commits listing Claude as a co-author modified the file in 539 of 1,105 traced repositories.
The broader security implications of AI-assisted development are also illustrated by AI-assisted exploit chaining against OpenAI, where model capabilities were used to chain weaknesses into a successful OpenAI compromise scenario.
Secrets can persist after a file is deleted
Apiiro located 104,185 copies of the local settings file in 103,617 repositories. Roughly 1.1% contained secrets. More than one-third of those secrets enabled direct database access, including 379 database passwords; the set also included 43 SSH logins, 42 GitHub, GitLab and npm tokens, and 23 AWS keys.
As of Monday, every identified file containing a secret remained on its repository’s default branch. Half had been present for at least 217 days. Git history created an additional exposure: 734 more secrets appeared in old versions of the file across 509 repositories even though they were absent from the current version, often because the file had been deleted. Apiiro also found 211 forks of 74 repositories carrying the same secrets as their originals.
The risk is not limited to the local file. Apiiro found secrets in 298 copies of the shared .claude/settings.json file, which teams may intentionally commit, and counted 2,539 secrets across 1,994 repositories when shared settings, historical versions and saved agent chat logs were included. Of 16 coding agents reviewed by the researchers, Claude Code was the only one confirmed to save the full approved command in a project file by default.
Rotation must precede repository cleanup
Apiiro recommends searching GitHub organizations for both Claude settings files and reviewing repository history even where a file has been removed. Credentials found in current or historical copies should be rotated before cleanup, because deletion cannot revoke a password, key, or token that may already have been copied.
Teams can stop tracking the local file with git rm --cached .claude/settings.local.json and add it to the repository’s own .gitignore. They should also remove rules that embed secrets on developer machines. Commands should reference a secrets-manager variable such as $DB_URL, rather than contain the secret itself, and broad safe patterns can reduce the need to approve individual credential-bearing commands.
Security teams should treat agent directories and memory files as potential secret stores, scan them in pre-commit checks and CI including Git history, and ensure detection covers passwords inside command lines as well as recognised key formats. The immediate business implication is clear: organisations need credential rotation and repository-history review as part of their controls for AI coding tools, not merely a local ignore rule.