How Claude Code Settings Files Ended Up Exposing Secrets on GitHub

Introduction

AI coding agents are moving beyond code suggestions and increasingly execute shell commands on a developer’s behalf. That shift creates a new security boundary: the local files used to remember permissions and workflow preferences. Researchers at Apiiro found that Claude Code settings files had been uploaded to public GitHub repositories, with some containing database passwords, API tokens, private keys, and root logins.

What caused the exposure

Claude Code can save a permission rule when a user approves an automated shell command. Selecting the option equivalent to “Yes, and don’t ask again” stores that decision in the local .claude/settings.local.json file. In some cases, the rule is represented as a pattern. In others, the original command is written into the file unchanged. If a command contains a credential directly on the command line, that credential can be persisted alongside the permission rule.

The file is relatively low-risk if it remains on the developer’s machine and that machine is secure. The difficulty begins when the file crosses into source control. Anthropic’s documentation says the file is generally covered by a developer’s global .gitignore. A global ignore rule, however, is not the same as a repository-level safeguard. The protection may not follow a project to another computer, may not exist when a directory is later turned into a repository, or may be bypassed when a file is manually staged. Apiiro also reported cases in which Claude Code committed changes to the settings file without a user explicitly initiating that action.

Key findings

• Apiiro found more than 100,000 public cases involving uploaded Claude Code local settings files.
• About 1,100 cases, connected to 63 organizations, contained secrets such as API tokens, database passwords, or private keys.
• Removing a file from the original repository does not necessarily remove it from GitHub forks.
• Around 215 of the identified secrets were not detected by the popular gitleaks and TruffleHog scanners.
• Related concerns had appeared in a Claude Code bug report as early as August 2025, but the reports were closed after 60 days without activity.

Why this matters

The incident is not simply about a missing ignore rule. It exposes a broader design issue in agentic development tools: authorization, command execution, local state, and version-control actions can become connected through a single interaction. In a conventional workflow, a developer may consciously edit a configuration file before committing it. An agent can create or modify that file as a side effect of carrying out a task, while the developer focuses on the resulting code.

Claude Code representatives said the team was investigating ways to prevent the problem. They recommended auto mode and secret-scanning tools, and indicated that built-in scanning was being considered. Those measures may reduce exposure, but they are not complete guarantees. The source material notes that sensitive commands can still be saved in settings files in auto mode, and that two widely used scanners missed a portion of the discovered secrets.

Developers should therefore add .claude/settings.local.json to the repository’s own .gitignore, inspect staged changes before every commit, and scan both working trees and history. Any exposed password or token should be rotated immediately. Removing the visible file is not enough when the data may remain in commit history or forks.

The larger lesson is that AI coding agents need secure defaults for local state, permission persistence, automated commits, and credential handling—not only protections against malicious prompts or unauthorized command execution.

Source: Ars Technica AI