Apiiro finds secrets in 1,122 of 104,185 public copies of Claude Code's settings.local.json on GitHub

TLDR

• Apiiro says Claude Code's "Yes, and don't ask again" can save approved commands, secrets included, to .claude/settings.local.json.¹⁵
• Apiiro found secrets in 1,122 of 104,185 public copies; wider scope gives 2,539 secrets across 1,994 repositories.¹³⁴
• Anthropic's Boris Cherny says Claude Code has not scrubbed secrets; fixes under consideration may not fully solve it.⁷⁸

Apiiro researchers Shmulik Cohen and Matan Giladi say Claude Code's "Yes, and don't ask again" option can save a full approved command, secret included, in .claude/settings.local.json inside the project folder, and that public copies of that file on GitHub hold secrets.¹² iTWire and GBHackers date the research to 5 November, while The Hacker News, in an article dated 7 November, says Apiiro "said yesterday" that 1,122 public copies hold at least one secret.¹²³ By default Claude Code asks before running most shell commands, The Hacker News reports; choosing that option saves an allow rule, and the rule covers only what the prompt offered, sometimes a pattern such as npm test * and sometimes one exact command, in which case any password or token typed into it is saved in plain text.¹ Anthropic's documentation says this choice for a Bash command is saved permanently per repository and command, in .claude/settings.local.json at the root of the git repository.⁵⁶ It also says Claude Code keeps the file out of commits by adding **/.claude/settings.local.json to the user's global git excludes file the first time it writes the file in a repository that does not already ignore it.⁶ Apiiro's point, as The Hacker News relays it, is that this protection stays in one user's git settings on one computer, does nothing for a file already committed, and does not travel with the project because Claude Code never adds the file to the project's own .gitignore.¹

Apiiro's search of public GitHub found 104,185 copies of the file in 103,617 repositories; 1,122 of them, about 1.1 per cent, hold at least one secret, and together those files hold 1,379 distinct secrets.¹² The Hacker News says a value counted as a secret when it matched a known key format, or when a password or token sat beside the address of a public server, and an AI reviewer also had to agree.¹ It reports that more than a third of the secrets open a database directly, including 379 database passwords, along with 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys, and that the files belong to 63 organisations, mostly software companies.¹ GBHackers adds 122 Supabase service-role keys and 103 Supabase account tokens.³ The headline figures cover different scopes. The Hacker News headlines the 1,122 files, while GBHackers headlines 2,539 secrets across 1,994 repositories.¹³ Apiiro's own excerpt, published by DataBreaches.net, says 1,160 more secrets turned up in git history, in the shared settings.json that teams commit on purpose, and in agent chat transcripts saved in repositories.⁴ The Hacker News breaks part of that down: older versions of the local file hold 734 more secrets across 509 repositories that are in no current copy, 211 forks of 74 repositories carry the same secrets, and 298 of 76,011 copies of the shared .claude/settings.json hold secrets.¹ It adds that, as of Monday, every file with a secret was still on its repository's default branch, and in half of those repositories it had been there for at least 217 days.¹

The findings have limits. Apiiro did not test whether any of the secrets still work, The Hacker News reports, but one company the researchers notified confirmed its key had been live.¹ iTWire says Apiiro collected the data between 1 and 3 November and notified affected organisations on 2 and 3 November, and writes that the findings establish an exposure risk rather than a demonstrated breach.² In 539 of the 1,105 repositories the researchers traced, a commit listing Claude as co-author changed the file, which they take to mean Claude often commits it itself; iTWire says this does not establish that Claude introduced or pushed every exposed credential.¹² iTWire also notes that Apiiro sells application and agent security products, that its totals are the company's own findings rather than an independent replication, and that an August 2025 Claude Code issue describing the same behaviour was closed automatically in January 2026, while security firm ironPeak described a similar case in February 2026.² The Hacker News says that, according to the researchers, the four related reports they cite were all closed by the same bot and none got a reply from Anthropic.¹

Apiiro's advice for developers, as The Hacker News lists it, starts with a search of the GitHub organisation for .claude/settings.local.json and .claude/settings.json, including each repository's git history.¹ The researchers say to rotate every password, token and key the files have ever held before cleaning up, then stop tracking the local file with git rm --cached .claude/settings.local.json and add it to the repository's own .gitignore.¹ They also advise opening the file on one's own computer, even if it was never committed, and deleting every rule that contains a secret; keeping secrets out of commands by referring to them as variables from a secrets manager, such as $DB_URL; and approving patterns such as Bash(npm run:*) rather than single commands.¹ iTWire cautions that putting the password in an inline environment-variable assignment still places it in the command text.² For security teams, the researchers recommend treating agent folders such as .claude/, .cursor/, .gemini/ and .specstory/ as holding secrets, adding them to pre-commit and CI secret scanning, and adding .claude/settings.local.json to organisation .gitignore templates.¹ They say scanners need to catch passwords inside commands: of the 1,122 files with a secret, gitleaks flagged 564, TruffleHog 643 and neither flagged 215.¹ The researchers also say that, of 16 coding agents whose documentation they compared, Claude Code is the only one confirmed to save the full approved command in a project file by default.¹

Why it matters: a saved approval rule can hold a plain-text secret, Apiiro says, and the git protection Anthropic describes covers only one computer; Cherny says Anthropic is still weighing fixes, so the researchers' advice to rotate exposed credentials before any cleanup stands.¹⁶⁷

Update, 9 November 2026: Anthropic has responded in public. Boris Cherny, whom iTnews describes as head of Claude Code at Anthropic, commented in the Hacker News discussion of Apiiro's research on 7 November, UTC, that there are "a few possible approaches: making sure auto mode catches this, building in basic secret scanning".⁸ iTnews quotes him saying that "Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this", and reports that he said the approaches might not fix the problem.⁷ When a reader pointed out the same exposure could occur in auto mode, Cherny replied "Yeah good catch", and wrote that Anthropic is thinking through what it can do to improve this and welcomes ideas.⁸

Cherny's account of the cause differs from Apiiro's. iTnews reports that he argued that because Claude Code gitignores the file on creation, the exposed copies had been created manually and checked in, and that he recommended auto mode over permission rules, together with the secret scanning offered by GitHub and other hosts.⁷ He wrote that auto mode "is significantly safer than manual approval in practice".⁸ Apiiro's point, as The Hacker News relays it, is that Claude Code's gitignore protection sits in one user's global git excludes on one computer and does not travel with the project, and that in 539 of the 1,105 repositories the researchers traced, a commit listing Claude as co-author changed the file.¹

iTnews adds that Apiiro shared the research with Anthropic before publication and reproduced the behaviour on Anthropic's current models, noting that it is a property of Claude Code rather than the model.⁷ Among the exposed secrets of the 63 affected organisations, iTnews lists a database vendor's own cloud API key with management access, a software agency's production Square token and the owner password for a medical-records app's cloud database.⁷ It also reports that Check Point-owned Lakera found credentials in 33 such files across 30 packages published to the npm registry in April, and that the Shai-Hulud npm worm ran TruffleHog over victims' files in September 2025.⁷