Claude Code Settings File Is Leaking Passwords to Public GitHub Repositories

Developers who click “Yes, and don’t ask again” in Claude Code may be saving more than a shortcut. The Claude Code settings file, .claude/settings.local.json, stores the full text of every command you approve, and that includes any password you typed into it. Security firm Apiiro says it has found those secrets sitting in public GitHub repositories, as reported by The Hacker News.

What the Claude Code settings file stores

Claude Code asks permission before it runs most shell commands. If you choose the standing approval, it saves an allow rule. Anthropic’s settings documentation says the rule goes into .claude/settings.local.json and that Claude Code keeps the file out of your commits by adding it to your global git excludes.

That protection has limits. A global exclude lives on one machine. It is not in the project’s .gitignore, so a colleague, a second laptop or a build server will not inherit it. The documentation also says that if you create the file by hand, you must ignore it yourself.

A rule can be a pattern such as npm test *. It can also be one exact command. If the exact command contains a database password, the password is saved in plain text.

The numbers Apiiro reports

According to The Hacker News, Apiiro searched public GitHub and found 104,185 copies of the file. Of those, 1,122 held at least one secret, 1,379 secrets in total. Apiiro did not test whether the secrets still worked, though one company it contacted confirmed that its key was live.

Over a third of the secrets open databases directly, including 379 database passwords. Others were 43 SSH logins, 42 source-control and package tokens, and 23 AWS keys. Apiiro also says every affected file was still on its repository’s default branch, and in half of them it had been there for at least 217 days.

These are Apiiro’s figures. We could not open its write-up during our checks, so treat the exact counts as the firm’s claims rather than independently confirmed numbers.

It is not only GitHub

A separate study points the same way. Check Point researchers monitored about 46,500 npm packages and found 428 that shipped the Claude Code settings file, 33 of them holding credentials. npm has no standard exclusion for a hidden .claude folder, so a developer who publishes a package without checking the contents can ship the file without knowing.

The pattern is familiar. Teams learned to guard .env files years ago. A new tool created a new dotfile, and nobody added it to the list.

Why scanners miss the Claude Code settings file

The Hacker News says Gitleaks flagged 564 of the 1,122 files and TruffleHog 643, while neither caught 215. Most misses were passwords typed inside commands, such as after PGPASSWORD= or mysql -p. Scanners look for key formats. A bare password in a command line has no format.

So a clean scan does not prove a clean repository. This is where a manual secure code review still earns its place.

What it means for a small UK business

Most small firms do not think of an AI coding assistant as part of their attack surface. It is a developer’s tool, installed on a laptop, and nobody in the office manager’s chain has signed it off. Yet it now writes files into your repositories and remembers what you typed.

Think about who runs the commands. A contractor debugging a production database at five o’clock on a Friday will paste the connection string, approve it once and move on. The password lands in a file inside the project. If that project later goes public, or is shared with a supplier, the secret goes with it.

The fix has two parts, one technical and one habit. Technical, because secrets belong in a manager and not in command lines. A habit, because “don’t ask again” is a convenience that trades away a little scrutiny each time. Ask developers which tools write config into your repositories. Then check the answer against what is committed, including any Claude Code settings file.

A report that went unanswered

None of this is new. A user filed issue 5544 in August 2025, describing approved commands with API keys saved verbatim. A bot closed it as “not planned” in January 2026 after a period of inactivity. The issue page shows no reply from an Anthropic maintainer.

What to do this week

• Search your GitHub organisation for .claude/settings.local.json and .claude/settings.json, including history.
• Rotate every password, token and key those files have ever held, before you tidy anything up.
• Run git rm --cached on the local file and add it to the project’s .gitignore.
• Approve command patterns, not single commands, and pass secrets as environment variables.
• Add agent folders to pre-commit and CI secret scanning.

Found a leaked database credential in your search? Then a database configuration review will show what an attacker could reach with it. Aardwolf Security can scope that, or a wider test, if you get in touch.