Security researchers at Apiiro found secrets in publicly uploaded Claude Code settings files, showing how a convenience option for approved shell commands can become a credential leak.
When users select “Yes, and don’t ask again,” Claude Code can store the approved command in `.claude/settings.local.json`. If the command contains a password, token or private key, that value may be saved verbatim. Anthropic normally adds the file to a global Git ignore list, but the protection may not follow a repository to another machine or cover folders turned into repositories later.
Apiiro identified more than 100,000 public copies of the settings file. About 1,100 files from 63 organizations contained secrets, including database passwords, API tokens and root credentials. Removing a file does not necessarily solve the problem because its history or forks can retain the value. Two common scanners also missed 215 of the exposed secrets.
Claude Code team member Boris Cherny said the company is considering preventative improvements and recommended secret scanning and automatic permission routing. Developers should still treat an exposed credential as compromised: revoke or rotate it, remove it from history where possible, and add repository-level checks that block local settings and secrets before commits.