Apiiro finds Claude Code settings files exposed secrets on GitHub

Apiiro says Claude Code permission rules in public GitHub repositories contained credentials after developers granted standing approval to shell commands, according to research published November 5. In Apiiro’s current-file sample, 1,122 of 104,185 public .claude/settings.local.json files met its definition of containing a real secret.

The sequence starts when Claude Code proposes a shell command. Anthropic’s permissions documentation says that in Manual mode, choosing “Yes, and don’t ask again” for a Bash command can save a permanent rule for that repository. If the proposed command contains a credential, Apiiro said, the saved rule can preserve the literal command—including the credential—in .claude/settings.local.json at the repository root.

Anthropic describes that file as a project-local place for personal settings and says Claude Code keeps it out of Git when the tool creates it. Apiiro said the protection goes into the developer’s global Git excludes file rather than the repository’s own .gitignore. Because that exclusion does not travel with the repository, it may not protect a copy on another machine. It may also miss a folder that later becomes a repository or a file Git already tracks. Apiiro said Claude Code can append new approvals to an already tracked file without warning the user.

Apiiro said its read-only GitHub searches, conducted November 1–3, found 104,185 current local-settings files across the default branches of 103,617 repositories. The company classified 1,122 files, or 1.1%, as containing a real secret, representing 1,379 distinct values. After adding earlier Git history, shared .claude/settings.json files and agent transcripts, Apiiro put the study total at 2,539 distinct classified secrets across 1,994 public repositories. Those figures cover Apiiro’s documented public-repository sample, not all Claude Code users or private repositories.

Apiiro defined a real secret as a value matching a known provider credential format, or a password or token paired with a public host, after applying its stated false-positive filters. The company said it did not use or test any credential or contact any host. Its classification therefore does not establish that every credential was valid when collected or that any was exploited. Apiiro also said its Git-history analysis covered 43,120 repositories and that its history count was a floor. The supplied evidence does not independently reproduce the company’s search, deduplication or classification dataset.

Boris Cherny, identifying himself as being from the Claude Code team, said Claude Code historically had not scrubbed secrets and that the team was looking at ways to prevent the exposure. He said the local settings file should not be checked into source control. Cherny also said exposed copies had been manually created and committed because Claude Code automatically ignores the file when it creates it. The available evidence does not establish that explanation for every exposed file. Apiiro separately said a Claude-co-authored commit changed the settings file in 539 of 1,105 repositories with a classified secret that it traced, though co-authorship does not show who chose to publish the file.

In a follow-up response, Cherny said the team planned to prototype possible mitigations, including having auto mode catch the condition and adding basic secret scanning, before deciding what to ship.