Key facts
- Apiiro said about 1,100 of the more than 100,000 exposed settings files contained secrets, drawn from 63 organizations.
- Claude Code stores approved shell commands in a local .claude/settings.local.json file, sometimes writing the command verbatim.
- Anthropic's documentation says the settings file is added to the developer's global .gitignore list, which does not apply at the repository level.
- Apiiro said Claude Code will in many cases commit changes to the settings file without user input.
- Secrets can persist in forks of a repository after the original file is removed, Apiiro said.
AI security researchers at Apiiro found that Claude Code's local settings files had been uploaded to public GitHub repositories in more than 100,000 cases, and that about 1,100 of those files, from 63 different organizations, contained secrets including public API tokens, database passwords and private keys. The findings were published on November 9, 2026.
The exposure stems from how Claude Code handles approval for automated shell commands. When a user selects the "Yes, and don't ask again" option, that choice is stored as a rule in the local ".claude/settings.local.json" file. The rule is sometimes coded as a pattern, but the command itself is often written to the file as is, including any sensitive information embedded in it.
Anthropic's Claude Code documentation says the settings file is added to the developer's global .gitignore list, which usually prevents it from being shared publicly. Apiiro said that setting is not reflected at the repository level, so the file can be uploaded if a repository is cloned to another machine or a folder becomes a repository later. Apiiro also said Claude Code will in many cases commit changes to the settings file without user input.
Apiiro said secrets can persist in forks of the original project after the files are discovered and removed from a repository.