Apiiro found 1,122 public Claude Code settings files containing secrets, after saved command approvals preserved credentials in plain text.
How a saved approval can expose secrets
Claude Code can ask before running a shell command and offer to remember approval. Choosing “Yes, and don’t ask again” saves an allow rule in .claude/settings.local.json. If the approved command contains a password or token, the rule may save it in plain text. Apiiro reproduced this with different Claude models, pointing to how Claude Code handles permissions rather than to one model.
Developers may pass credentials to command-line tools while debugging a database connection or deployment, as an environment variable or argument. Repeated permission prompts can also encourage them to approve a command once and move on. Apiiro described this explanation as an inference from the workflow and command formats researchers found.
What Apiiro found in public files
Apiiro found at least one secret in 1,122 of 104,185 public copies of settings.local.json on GitHub. Those files contained 1,379 distinct secrets. Counting older Git history, shared settings files and saved agent transcripts, the researchers reported 2,539 secrets across 1,994 repositories.
The secrets included database passwords, SSH logins, software-platform tokens and cloud keys. The count shows exposure, not that every credential still worked or was misused. Apiiro said one organization it notified confirmed a key was live, but the firm did not establish that attackers had used the discovered secrets.
Why the files can remain exposed
Anthropic’s documentation says Claude Code adds the local settings file to a user’s global Git excludes when it first creates the file in a repository that does not already ignore it. This safeguard applies to the developer’s machine, not the shared project. It cannot undo a file already tracked in Git or erase copies in repository history and forks.
On December 4, 2025, a developer reported a similar exposure in Anthropic’s GitHub issue tracker, describing credentials in the local settings file reaching a public repository. The report showed the risk had surfaced before Apiiro measured its scale.
Passwords embedded in ordinary command syntax may not match familiar API key formats, so generic secret scanners can miss them. Agent configuration files, transcripts and other working data may also contain credentials. A valid key can provide a route into a database, cloud account or software supply chain; its reach depends on what it can access.
What Anthropic and organizations can do
Anthropic’s Claude Code lead, Boris Cherny, acknowledged the issue and said the company was looking into safeguards, including auto mode and basic secret scanning. These were proposals, not a confirmed fix or release date in the latest reporting.
Organizations can search repositories and their histories for the files, rotate exposed credentials, and remove or clean up tracked copies. Deleting a file alone cannot make an already published credential secret again.