TruffleHog
1Stories
0Linked CVEs
1Other name
- Also known as
- Trufflehog
Latest
Claude Code approval option can save secrets to settings files that leak to public GitHub repositories
Apiiro researchers found that Claude Code's "Yes, and don't ask again" option stores approved shell commands, including embedded passwords and API keys, in .claude/settings.local.json. Across 104,185 public copies of that file, they identified 2,539 distinct secrets in 1,994 repositories, affecting 63 organisations, including 379 database passwords, 122 Supabase service-role keys and 43 SSH logins. Standard scanners Gitleaks and TruffleHog missed 215 of the 1,122 affected local settings files.