Claude Code is accidentally exposing secrets all over GitHub

Researchers at Apiiro found that Claude Code's local settings file is leaking real credentials onto public GitHub. When a developer picks the option to approve a shell command and not be asked again, Claude Code can store the full command, including any embedded secret, in .claude/settings.local.json. Apiiro found more than 100,000 of these files in public repositories. Roughly 1,100, from 63 organizations, contained secrets like API tokens, database passwords, private keys and root logins.

The file is supposed to be protected by a global .gitignore entry, but that protection does not travel with the repo. Clone to a new machine, or turn a folder into a repo later, and the file can go public. Apiiro also says Claude Code itself sometimes commits changes to that settings file without the user's input.

This is not exotic. It is the most ordinary path in software, and it hands attackers working credentials.

We're big believers in coding agents. They are among the clearest cases of AI doing useful work today. That's exactly why this one stings. The failure isn't the model going rogue. It's a product design choice that treats a security-sensitive record like a preferences file.

The most troubling detail for us is the timeline. Ars reports the issue was flagged in a bug report as early as August 2025, and related reports noted the file sometimes wasn't ignored or that sensitive commands landed in unprotected files. Those reports were closed automatically after 60 days of inactivity. An auto-close policy is fine for feature requests. It is not fine for credential exposure. That's a process failure, and it's worth more scrutiny than the bug itself.

We also want to be fair. Anthropic's Boris Cherny responded on Hacker News that the team is looking at prevention, and acknowledged a commenter's point that auto mode can still save sensitive commands as a good catch. His view that these files should essentially never be checked in is correct. But that's the user's ideal behavior, not the tool's actual behavior, and Apiiro says the tool sometimes commits the file on its own. A safe default has to survive ordinary mistakes.

The recommended mitigation, secret scanners, is weaker than it sounds. Apiiro found 215 of the roughly 1,100 exposed secrets were missed by gitleaks and TruffleHog. And removing the file doesn't undo exposure if the repo was forked. Anyone affected should treat those credentials as burned and rotate them.

Where this leads if it scales is the part I'm watching most closely. Agents are being granted permission to run commands, remember approvals and commit code on their own. Every one of those conveniences creates a new place where secrets can be written down. If the industry keeps shipping agents with memory but without a secrets model, this will not be the last leak of its kind. Ars already points to Meta suspending its Muse agent's sharing feature last month after researchers found guessable URLs. The pattern is forming.

The fix is not complicated in principle: never persist raw command strings containing secrets, pattern-match and redact before writing, add repo-level ignore rules, and scan before any agent-initiated commit. We'd like to see Anthropic ship those as defaults, not options.

Claude Code asks users to approve shell commands. Choosing to approve and not be asked again stores a rule locally, sometimes as a pattern but often as the literal command. Anthropic's documentation says the file is added to the developer's global .gitignore, which does not apply when a repo is cloned elsewhere or created later.