AI security researchers at Apiiro discovered thousands of sensitive secrets, including database passwords, API tokens, and root logins, embedded within Claude Code settings files on public GitHub repositories. The leak occurs because the tool's local settings file, .claude/settings.local.json, can contain sensitive information when users select the “Yes, and don’t ask again” option to approve automated shell commands. While Anthropic documentation states that this file is added to a developer's global .gitignore list to prevent public sharing, the setting is not reflected at the individual repository level.
This discrepancy allows the file to be uploaded accidentally if a repository is cloned to another machine or if a folder is converted into a repository later. Apiiro researchers reported that Claude Code often commits changes to the settings file without user input. The researchers identified over 100,000 instances where the local settings file had been uploaded to public GitHub repositories. Of those instances, approximately 1,100 from 63 different organizations contained actual secrets such as private keys or public API tokens.
Security risks may persist even after the files are identified and removed from a repository. Apiiro noted that secrets can remain accessible if a GitHub user creates a fork of the original project without removing the sensitive data.
