Claude Code approvals expose secrets in 1,122 public repos

When you pick "Yes, and don't ask again" on a command in Claude Code, the assistant saves that approval to .claude/settings.local.json. If the command you approved had a password or token in it, the secret goes in too — verbatim, in plaintext. Security firm Apiiro searched public GitHub and found that file in 104,185 copies across 103,617 repositories, of which 1,122 copies (~1.1%) hold at least one secret — 1,379 distinct secrets in all. The research is reported by The Hacker News; Apiiro's own writeup was not publicly reachable at publication time, so this post is based on that reporting plus artifacts we could verify directly.

Why the file leaks

Two behaviors combine. First, "don't ask again" stores the approved command. Broad patterns (e.g. npm test *) are harmless; it's the exact single commands — the ones with a credential baked in — that capture secrets. The behavior reproduces on current models, including Opus 5.5 and Fable 5.1, and is documented as how the local settings file works.

Second, the protection is local-only. On first write in a git repo, Claude Code adds the file to the user's global git excludes — not the project's own .gitignore. So the file stays untracked on the machine that created it, and committed everywhere else: a teammate who clones the repo and hits "don't ask again" has no such exclude, and their copy ships to the remote. A long-standing bug report (issue #5544, filed August 2025) described exactly this; an automated bot closed it as "not planned." Anthropic has not publicly commented on Apiiro's findings.

What's in the 1,379 secrets

Per Apiiro, as reported:

• More than a third open a database directly, including 379 database passwords.
• 43 SSH logins for public servers.
• 42 tokens for GitHub, GitLab, and npm.
• 23 AWS keys.

Sixty-three organizations own them; the standout cases are a database vendor's admin-level cloud key and the owner password of a medical-records database. Apiiro did not test whether the secrets still work, but says one notified company confirmed its key was live. As of the research, every file with a secret was still on its repository's default branch, and in half of those repos it had sat there for at least 217 days. Deleted older versions add 734 more secrets across 509 repositories; forks and shared .claude/settings.json files push the grand total to 2,539 secrets across 1,994 repositories.

The scanners miss it

Apiiro ran gitleaks and TruffleHog over the files: gitleaks flagged 564 of the 1,122, TruffleHog 643, and neither caught 215. The misses are mostly passwords typed inside commands — after PGPASSWORD=, sshpass -p, or mysql -p — which secret scanners don't recognize as credentials. If you rely on a default scanner to catch this class, it won't.

Action checklist

1. Search your GitHub org for .claude/settings.local.json and .claude/settings.json, including deleted files in git history.
2. Rotate every password, token, and key those files have ever held — do this before you clean anything up, since removal doesn't recall what already leaked.
3. git rm --cached the local settings file, add .claude/settings.local.json to the repo's .gitignore, and to your org's .gitignore templates.
4. Delete any rule containing a secret from local copies, including uncommitted ones.
5. Stop typing secrets into commands. Reference them from a secrets manager or environment variables, and approve command patterns rather than exact commands.
6. Add agent folders (.claude/, .cursor/, .gemini/) and agent memory files to pre-commit and CI secret scanning — history included — and make sure your scanner catches passwords inside commands.

Context

This is the same failure mode behind a run of AI-coding-tool exposures: the Claude Code GitHub Action prompt-injection chain and the Cursor/Claude Code extension SSH backdoor both turned on config and extension surfaces that nobody was treating as sensitive. Agent working directories now hold the same risk profile as your .env files — scope them, scan them, and keep live credentials out of them. The AI angle makes headlines; the fix is ordinary secret hygiene.