Researchers at security firm Apiiro found passwords, API keys and other credentials in 1,122 public GitHub copies of a Claude Code settings file after its “don’t ask again” option saved some commands with secrets typed directly into them.
Apiiro counted 1,379 different secrets in those files, which were among 104,185 public copies it examined. Claude Code can save ongoing permission for a shell command in `.claude/settings.local.json`. If a command contains a password or token, the saved rule may include it as plain text.
The tool uses a local Git exclusion to help keep the file out of commits made on a user’s machine. But that protection may not cover files already tracked or keep the setting excluded when a project is copied or handled elsewhere. The exposed information included database passwords, SSH logins and cloud-service keys.
Apiiro’s broader count, which covered Git history and other files, found 2,539 secrets across 1,994 repositories. Researchers said they did not test whether the credentials still worked. The findings therefore show exposure, not proof that attackers used the credentials.
They advised affected teams to replace credentials before removing files or rewriting repository history. Old commits and forks can preserve copies.