Claude Code approval option can save secrets to settings files that leak to public GitHub repositories
- Severity
- High
- Sources
- 2
What happened
Apiiro found 2,539 distinct secrets across 1,994 public repositories, from 104,185 public copies of .claude/settings.local.json; real secrets appeared in 1,122 files, with the rest found in earlier commits, shared settings and agent transcripts (collection 1-3 November 2026). Persistent allow rules store full shell commands, so PGPASSWORD=, sshpass -p and header-embedded credentials are saved in plaintext. Gitleaks flagged 564 files and TruffleHog 643; 215 were missed. Remediation: rotate exposed credentials first, then run git rm --cached on the file, add it to .gitignore, purge history, and use secret-manager references.
For security analysts · Written by AI from 2 sources · Wrong?
What to do
- Rotate any credentials found in Claude Code settings files before removing them from repositories.
- Run git rm --cached .claude/settings.local.json and add the path to .gitignore.
- Search current files and Git history for .claude/settings.local.json and review shared .claude/settings.json allow rules for passwords or tokens.
- Use secret-manager references rather than literal passwords in commands.
Written by AI from the sources, checked against them
Full story timeline · 2 updates
Who reported · 2 outlets
Who and what is in it
Malware
Companies
Products