A single click in Anthropic’s Claude Code has been quietly copying developers’ passwords and API keys into a file that anyone on GitHub can read. Security firm Apiiro said on November 5 that 1,122 public copies of that file hold at least one secret, and the total reaches 2,539 secrets across 1,994 repositories once git history and shared settings files are counted.

The cause isn’t a hack or a prompt-injection trick. It’s a convenience feature doing exactly what it was built to do.

The file is .claude/settings.local.json.

How a password ends up in the file

Claude Code asks before it runs most shell commands. Pick “Yes, and don’t ask again” and it saves an allow rule in .claude/settings.local.json, inside the project folder. Matching commands then run without asking in later sessions.

Sometimes the rule is a pattern, like npm test *. Sometimes it’s one exact command. When it’s the exact command, any password or token typed into it gets saved too, in plain text. Apiiro’s researchers reproduced the behavior with the latest models, Opus 5.5 and Fable 5.1.

Claude Code does try to keep the file out of git. The first time it writes the file in a repository, it adds the file to the developer’s global git excludes. Git on that machine then ignores it in every repo.

That protection lives in one user’s git settings on one computer. It does nothing for a file that was already committed, and Claude Code never adds the file to the project’s own .gitignore, so the protection doesn’t travel with the project. Worse, the agent itself often does the committing: in 539 of the 1,105 repositories Apiiro traced, a commit listing Claude as a co-author changed the file.

What Apiiro found on public GitHub

Apiiro scanned public GitHub between November 1 and 3 and found 104,185 copies of the file in 103,617 repositories. About 1.1 percent of them, 1,122 copies, held at least one secret, or 1,379 distinct credentials in total.

More than a third of the secrets open a database directly: 379 database passwords, plus 122 Supabase service-role keys and 103 Supabase account tokens. Beyond databases, the haul includes 43 SSH logins for public servers, 42 tokens for GitHub, GitLab, and npm, and 23 AWS keys.

Apiiro counts 63 organizations among the owners, mostly software companies. The strongest cases Apiiro cites are a database vendor’s own admin-level cloud key, a production Azure PostgreSQL password, a Square production token, and the owner password of a medical-records database.

These files haven’t been sitting there for a weekend. In half the affected repositories, the file had been public for at least 217 days, and as of Apiiro’s November 2 snapshot, every secret-bearing file was still on its repository’s default branch.

Deleting the file doesn’t undo the damage. Older versions hold 734 more secrets across 509 repositories, and 211 forks of 74 repositories carry the same secrets as the originals. Shared settings files that teams commit on purpose add more: 298 of 76,011 copies of .claude/settings.json held a secret. Counting those, the history, and saved agent chat logs, Apiiro’s total is 2,539 secrets across 1,994 repositories.

Apiiro says it didn’t test whether any of the credentials still work. One company the researchers notified earlier in the week confirmed its key had been live.

The scanners missed 215 of them

Apiiro ran gitleaks and TruffleHog over every copy, without the tools’ verification step. Gitleaks flagged 564 of the 1,122 files. TruffleHog caught 643. Neither flagged 215.

Most of the misses are passwords typed inside commands. Scanners look for known key formats, and a password after PGPASSWORD=, sshpass -p, or mysql -p looks like an ordinary word in an ordinary command line.

There’s a second, sharper point here. Of 16 coding agents whose documentation Apiiro compared, Claude Code is the only one confirmed to save the full approved command in a project file by default.

Users flagged this in August 2025

This isn’t new. A bug report filed on August 11, 2025, said approved commands with API keys and tokens were being stored word for word in settings.local.json. An automated bot closed it as “not planned” on January 3, 2026, after 60 days without activity.

Apiiro cites four related reports. All four have now been closed by the same bot, the most recent the day before the research was published. None received a reply from Anthropic, the researchers say.

Apiiro calls the saving “Claude Code’s own behavior, not the model’s”: the tool writes the rule, not the model. Anthropic had not published a product response at the time of writing.

What to do if you use Claude Code

Apiiro’s first piece of advice is blunt: rotate first. Change every password, token, and key the file has ever held, then clean up. Deleting the file first leaves live credentials sitting in git history.

Search your GitHub organization for .claude/settings.local.json and .claude/settings.json, and check each repository’s git history for them, even where the files are gone. Stop tracking the local file with git rm --cached .claude/settings.local.json and add it to the project’s own .gitignore. Open the file on your own machine, even if it was never committed, and delete every rule that contains a secret.

Going forward, keep secrets out of commands entirely. Refer to them as variables from a secrets manager, such as $DB_URL, so the saved rule holds the variable name and not the secret. Approve patterns, like Bash(npm run:*), instead of single commands.

Why this matters

The uncomfortable part of this story isn’t the number. It’s how ordinary the mistake is. Nobody typed a password into a public repo on purpose. They clicked a button that promised to stop asking, and the tool did the rest.

That pattern is the real story of AI coding agents in 2026. The tools move fast, they touch real systems, and the files they write, settings, transcripts, memory, are turning into a new class of secret sprawl. Security teams already treat .env files as radioactive. Apiiro’s recommendation is to treat agent folders the same way: .claude/, .cursor/, .gemini/, and agent memory files, on laptops as well as in repositories, added to pre-commit and CI scanning, including git history.

Anthropic built Claude Code to remove friction from development. This week showed what that friction was protecting.

FAQ

How did Claude Code leak passwords to GitHub?

Choosing “Yes, and don’t ask again” saves the full approved shell command, secret included, as a plain-text allow rule in .claude/settings.local.json. If that file gets committed and pushed, the secret goes public with it.

How many secrets did Apiiro find?

1,122 public copies of the file held at least one secret, 1,379 distinct credentials in total. Counting git history, shared settings files, and saved agent chat logs, the total reaches 2,539 secrets across 1,994 repositories.

Does deleting the file fix the leak?

No. Older versions stay in git history and in forks of the repository, so the fix starts with rotating every credential the file ever held, then removing the file from tracking.

What should Claude Code users do now?

Search your GitHub organization for .claude/settings.local.json and .claude/settings.json, including git history, rotate any credential they ever held, add the file to the project’s .gitignore, and keep secrets out of commands by using variables like $DB_URL.

Sources: The Hacker News, Apiiro, The Decoder, AI Weekly