Security Flaw in Claude Code Exposes Secrets in Public GitHub Repositories

Passwords and API keys entered by developers into commands approved in Claude Code are publicly accessible in GitHub repositories. This exposure allows anyone to read sensitive information stored in these files.

When a user selects “Yes, and don’t ask again,” Anthropic’s AI coding assistant saves the command verbatim, including any secrets, in a project settings file. Software security company Apiiro reported that 1,122 public copies of this file contain at least one secret, although it did not verify whether any of these secrets are still active.

The file in question is named .claude/settings.local.json. Simply removing it from a project does not eliminate the risk, as older versions remain in the git history and in forks of the repository. The researchers advise developers to rotate all passwords, tokens, and keys that the file has ever contained before cleaning up.

How Secrets Are Saved

By default, Claude Code prompts users before executing most shell commands. If the user chooses “Yes, and don’t ask again,” it saves an allow rule in .claude/settings.local.json within the project. This behavior is outlined in its permissions documentation. Subsequent commands that match the saved prompt can run without further confirmation in future sessions.

The saved rule can either be a pattern, such as npm test *, or an exact command. When the latter is the case, any password or token entered is also saved in plain text. The researchers found instances of saved commands containing secrets in public files and replicated this behavior using the latest models, Opus 5.5 and Fable 5.1.

To mitigate the risk, Claude Code attempts to keep the file out of git. Upon its first write in a git repository, it adds the file to the user’s global git excludes, which instructs git to ignore the file in all repositories on that computer. However, this protection only applies to new commits and does not affect files already committed.

Apiiro’s Findings

Apiiro’s investigation of public GitHub repositories revealed 104,185 copies of the file across 103,617 repositories. Approximately 1.1% of these copies, or 1,122, contain at least one secret, totaling 1,379 different secrets. A value is counted as a secret if it matches a known key format or if a password or token is associated with a public server address, and an AI reviewer must also approve it.

More than a third of the identified secrets provide direct access to databases, including 379 database passwords. Other secrets include 43 SSH logins for public servers, 42 tokens for GitHub, GitLab, and npm, and 23 AWS keys. Among the owners of these files are 63 organizations, primarily software companies of various sizes.

As of November 7, every file containing a secret remained on its repository’s default branch, with half of these files present for at least 217 days. Older versions of the file contain an additional 734 secrets across 509 repositories, typically because the file was deleted. Forks of the original repositories further disseminate these secrets.

Recommended Actions for Developers

Researchers recommend that developers take the following steps:

• Search GitHub organizations for .claude/settings.local.json and .claude/settings.json, checking each repository’s git history, even if the files are no longer present.
• Rotate all passwords, tokens, and keys that the files have ever contained before cleaning up.
• Stop tracking the local file using git rm –cached .claude/settings.local.json and add it to the repository’s .gitignore.
• Open the file on personal computers and delete any rules containing secrets.
• Use variables from a secrets manager, such as $DB_URL, instead of hardcoding secrets in commands.
• Approve command patterns, like Bash(npm run:*), rather than single commands.

Even copies that do not reach GitHub are significant, as the file is plain JSON and can reside in npm packages, Docker images, zip archives, or synced folders. Previous malware has targeted secrets on developer machines, highlighting the need for vigilance.

For security teams, the researchers suggest treating agent folders and memory files as containing secrets, similar to .env files. They should be included in pre-commit and CI secret scanning, ensuring that scanners can detect passwords within commands, not just known key formats. Additionally, organizations should add .claude/settings.local.json to their .gitignore templates and prioritize checking credentials associated with public servers.

Earlier reports indicated that Claude Code users had previously flagged this issue. A bug report filed on August 11, 2025, noted that approved commands with API keys and tokens were being stored verbatim in settings.local.json. An automated bot closed the report as “not planned” after 60 days without activity.

Source: The Hacker News