Claude Code settings files expose thousands of secrets on GitHub
Security researchers have found that local settings files from Anthropic's AI coding tool Claude Code are ending up in public GitHub repositories along with sensitive data. About 1,100 files from 63 organizations contained passwords, API tokens and private keys.
Claude Code, an AI programming tool developed by Anthropic, is leaving sensitive information in public GitHub repositories because of a flaw in how its settings files are handled. The finding comes from researchers at Apiiro, an AI security company. GitHub is a widely used platform for storing and sharing software code.
How the leak happens
When a user approves an automated shell command by choosing the “Yes, and don’t ask again” option, that decision is stored as a rule in the local “.claude/settings.local.json” file on the user's computer. The rule is sometimes written as a pattern, but the command often goes into the file unchanged, including any sensitive information embedded in it.
Keeping the file on a local machine is not a significant problem, provided the machine itself is not compromised. Anthropic's documentation says the file is added to the developer's global .gitignore list, which usually keeps it from being published. However, that setting is not reflected at the repository level, so the file can be uploaded by accident, for example when a repository is cloned onto another machine or when a folder becomes a repository later. Apiiro says that in many cases Claude Code itself commits changes to the file without any input from the user.
What the researchers found
Apiiro's researchers identified more than 100,000 cases in which Claude Code's local settings file had been uploaded to a public GitHub repository. Of these, about 1,100 files belonging to 63 different organizations contained secrets such as public API tokens, database passwords or private keys. The researchers also reported finding root logins.
Even after such a file is discovered and removed from a repository, the secrets can persist in forks of the original project if a GitHub user is not careful.
