Claude Code Secrets Leak: 1,122 Public settings.local.json Files

A Claude Code secrets leak: when a developer approves a command with "Yes, and don't ask again", Claude Code can save that exact command, including any password or token typed into it, in .claude/settings.local.json. Apiiro found 1,122 public copies of that file on GitHub holding at least one secret, 1,379 secrets in total. Deleting the file does not fix it. Rotate every credential it ever held, then clean up.

Claude Code, Anthropic's AI coding assistant, asks before running most shell commands. Choosing "Yes, and don't ask again" writes an allow rule into .claude/settings.local.json in the project, as its permissions documentation describes. Sometimes that rule is a pattern like npm test *. Sometimes it is the exact command, and then a database password after PGPASSWORD= or a token in a curl header is stored in plain text. Researchers at Apiiro reproduced this with current models, Opus 5.5 and Fable 5.1, according to The Hacker News.

Claude Code does try to keep the file out of git. The first time it writes the file inside a repository, it adds it to the user's global git excludes, per its settings documentation. The .local in the name suggests the file stays local, but git ignores nothing by name alone. That protection lives in one person's git config on one machine. It does not travel with the project, it does nothing for a file already committed, and Claude Code does not add the file to the project's own .gitignore. In 539 of the 1,105 repositories Apiiro traced, a commit co-authored by Claude changed the file.

How many secrets did the Claude Code settings.local.json leak expose?

Apiiro's research, as reported by The Hacker News, found 104,185 copies of the file across 103,617 public repositories. About 1.1% held a secret. Counting older versions in git history, the shared .claude/settings.json and saved agent chat logs, the total reaches 2,539 secrets across 1,994 repositories.

Apiiro did not test whether keys still work, but one notified company confirmed its key had been live. Every file with a secret was still on its default branch when the research was published, half of them for at least 217 days. Of 16 coding agents whose documentation Apiiro compared, Claude Code was the only one confirmed to save the full approved command in a project file by default. An August 2025 bug report describing the behavior was auto-closed as "not planned" by a bot after 60 days of inactivity.

Why didn't secret scanners catch these Claude Code leaks?

Most of the missed secrets are passwords typed inside commands. Scanners look for known key formats, and a password after mysql -p or sshpass -p looks like an ordinary word. Run without their verification step, gitleaks flagged 564 of the 1,122 files and TruffleHog 643; neither flagged 215. That gap matters because malware already hunts these folders: the Shai-Hulud worm ran TruffleHog over infected developer machines in September 2025.

How do you fix a leaked .claude/settings.local.json?

Rotate first, then clean up. Search your GitHub organization for .claude/settings.local.json and .claude/settings.json, including git history. Rotate every password, token and key those files ever held. Run git rm --cached .claude/settings.local.json and add the path to the repository's own .gitignore and your org's templates. Open the local file even if it was never committed and delete any rule containing a secret. Going forward, reference secrets as environment variables such as $DB_URL so the saved rule stores the name, not the value, and approve patterns like Bash(npm run:*) instead of single commands. GitHub's guide to removing sensitive data from a repository covers the history rewrite, and our guide on what to do after leaking an API key walks through the order.

Our read

Developers have learned not to commit .env files. Agent config folders like .claude/, .cursor/ and .gemini/ are the new .env, and few scanners or gitignore templates treat them that way yet. The broader lesson is that "approve once" convenience features turn transient commands into durable files. Treat agent folders as secret stores in pre-commit hooks, CI scans and history scans, and make sure your scanner catches passwords inside command lines. ARGUS scans for secrets with gitleaks plus entropy checks and marks each found key as live, rotated or test, so you know what to rotate first; command-line passwords are a known weak spot for format-based scanning, so review these folders directly too. More on finding hardcoded secrets in code, AI coding assistant security risks and how stolen keys get abused in LLMjacking. See ARGUS.

Reporting by The Hacker News; research by Apiiro; behavior per Claude Code docs.