Over 1,100 Claude Code settings files with real secrets found in public GitHub repos

How a saved permission became a leak

Claude Code, Anthropic's command-line coding agent, asks for permission before running commands. When a developer answers "Yes, and don't ask again," the tool records the approved command as an allow rule in .claude/settings.local.json, a file meant to stay on the developer's machine. If the command embeds a database password, API token or private key — a psql invocation prefixed with PGPASSWORD, for instance — the credential is written to disk alongside the permission.

Ars Technica reported that security firm Apiiro found more than 100,000 of these settings files in public GitHub repositories, around 1,100 of them holding credentials. A follow-up dev.to analysis by Cole Halton, drawing on Apiiro's data, gives the precise figures: 104,185 files scanned, 1,122 containing a real secret, and 2,539 secrets spread across 1,994 repositories. Another 734 secrets exist only in historical versions of the files and are invisible in current trees.

The ignore rule that never travels

Anthropic's documented safeguard adds the settings path to the user's global Git exclude file the first time Claude Code creates it. Halton recreated the scenario in a scratch repository with a fake password and identified two structural gaps. The exclude entry lives in one developer's global configuration, so it never travels with the repository to a CI runner or a teammate's computer. And Git ignore patterns govern untracked files only: once the file is staged, adding the exclude entry changes nothing, and each later approval keeps appending to a file Git is already tracking. On a machine lacking the entry, an ordinary git add . is enough to stage the settings file.

Claude Code does detect tracked settings files — Anthropic's permissions documentation says a tracked file is treated as repository-supplied and its allow rules are held until the folder is trusted. But per Apiiro, that detection is written to debug logs rather than surfaced to the user, and new approvals still land in the tracked file.

Mostly older installs, and a scanner blind spot

Halton's package-registry analysis adds context: of 562 published versions of Claude Code, 466 predate release 2.1.211 (July 15, 2026), the version that moved the local settings file to the repository root. Apiiro's median repository containing a real secret first committed the file around the end of March 2026, months before that change — pointing to accumulated installs rather than a single bad release.

Scanning is an imperfect catch. Apiiro ran gitleaks and TruffleHog over all 104,185 files: gitleaks flagged 564 of the 1,122 secret-bearing files, TruffleHog 643, and 215 were flagged by neither, roughly 19 percent. Per Halton, the blind spot is passwords embedded in commands — detectors match credential formats, and a password in front of a psql call has no recognizable shape. Apiiro's data also shows scale correlates with risk: about one in ten files over 8 KB held a real secret, versus fewer than one in 500 files under 500 bytes.

Response, and how other agents differ

Boris Cherny, who leads Claude Code, said in a discussion reported by Althacker that Anthropic is investigating ways to prevent the problem, reiterated that the local settings file should not be committed, and pointed to auto mode and secret scanning as mitigations. Apiiro reviewed documentation for 16 coding agents and identified Claude Code as the only one confirmed by default to persist the full approved command into a project file; OpenCode, by contrast, stores permissions as action-and-resource patterns such as denying reads of .env files, so no literal command line is saved. Suggested product-level fixes include warning when an approved command appears to contain a credential, redacting sensitive arguments before persisting, or keeping permission memory separate from the raw command text.

Why it matters

The incident reframes the security question around AI coding agents. The danger is not only the code they generate but the artifacts they leave behind — configuration files that quietly accumulate a record of what a developer approved. A settings file carrying a password looks like routine config in a diff, not like a leak, and both Git's ignore machinery and standard secret scanners miss parts of the problem. As agents take on more of the commit workflow themselves, defenses that assume careful manual habits stop matching how the tools are actually used, which shifts the burden onto vendors to build protection into the product rather than the documentation.