Claude Code saved passwords into 1,122 public GitHub settings files. Rotate first, then clean up

When a developer picks “Yes, and don’t ask again” in Claude Code, the assistant can save the exact command as a permission rule in .claude/settings.local.json. If that command had a password or API key in it, the secret is now in a plain JSON file in the project.

Apiiro searched public GitHub and found 1,122 copies of that file holding at least one secret, 1,379 distinct secrets in all. More than a third open a database directly.

Claude Code’s settings.local.json can hold the exact command you approved, password and all. Rotate what it held before you delete it.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Claude Code saved approved commands, passwords included

Apiiro’s November 5 research found 104,185 copies of .claude/settings.local.json in 103,617 public repositories. About 1.1% held a secret. The haul includes 379 database passwords, 43 SSH logins for public servers, 42 GitHub, GitLab and npm tokens, and 23 AWS keys, across 63 organizations.

Claude Code adds the file to a user’s global git excludes the first time it writes it, according to its settings documentation. That protection lives on one machine. It does nothing for a file already committed, and Claude Code never adds the file to the project’s own .gitignore. In 539 of 1,105 repositories traced, a commit co-authored by Claude changed the file.

• Older versions in git history hold 734 more secrets across 509 repositories, and 211 forks carry copies of the same secrets.
• Counting the shared .claude/settings.json, history and saved agent chat logs, Apiiro counted 2,539 secrets in 1,994 repositories.
• gitleaks flagged 564 of the 1,122 files and TruffleHog 643; neither caught 215, mostly passwords typed inside commands.

Teams whose repos carry .claude folders

This sits in repositories, but also in npm packages, Docker images, zip archives and synced folders, because the file is plain JSON in the project folder. Apiiro did not test whether the secrets still work. One company it notified confirmed its key had been live.

Common scanners look for known key formats. A password after PGPASSWORD=, sshpass -p or mysql -p looks like an ordinary word, so a clean scan does not clear these files.

Rotate first, then untrack the file

• Search your GitHub or GitLab organization for .claude/settings.local.json and .claude/settings.json, including git history where the file was deleted.
• Rotate every password, token and key those files have ever held before you clean up. Start with credentials paired with a public server address.
• Untrack the local file with git rm --cached .claude/settings.local.json and add it to each repository’s .gitignore and your org templates.
• Open the file on developer laptops, even where it was never committed, and delete rules that contain secrets.
• Have developers reference secrets as variables (for example $DB_URL) and approve patterns such as Bash(npm run:*) instead of single commands.

Details

• File: .claude/settings.local.json (per-project allow rules from “Yes, and don’t ask again”); also .claude/settings.json.
• Apiiro (November 5, 2026): 1,122 public copies with at least one secret; 1,379 distinct secrets; 734 more in history; 63 organizations. No CVE has been assigned.
• Vendor response: Apiiro says four related GitHub issues were closed by an automated bot without a reply from Anthropic.

Hunt / verify

• Add .claude/, .cursor/, .gemini/ and similar agent folders to pre-commit and CI secret scanning, including history.
• Grep agent folders for PGPASSWORD=, sshpass -p, mysql -p and connection strings with inline credentials.
• Check package and image build contexts for .claude/ folders that ship with releases.

Source: Apiiro research; The Hacker News write-up

Sources

• Apiiro: coding agents leaking secrets via “don’t ask again” (November 5, 2026)
• The Hacker News: Claude Code’s “Don’t Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
• Claude Code docs: Settings
• iTWire: Claude Code approval files found exposing company secrets on GitHub

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].