Passwords, API keys and other credentials approved through Anthropic’s Claude Code assistant have been exposed in public GitHub repositories, according to security company Apiiro, which identified 1,122 public copies of the tool’s local settings file containing at least one apparent secret. The findings show how a convenience feature intended to suppress repeated permission prompts can turn shell commands into committed plaintext credentials.
Claude Code’s documentation confirms that selecting “Yes, and don’t ask again” can permanently save an approval rule for a Bash command in .claude/settings.local.json at the repository root. Because the rule records the command pattern, a command containing a database password, access token or other secret can preserve that value in the JSON file. Anthropic’s permissions documentation says the local file is intended for personal settings and should be kept out of shared repositories.
Apiiro said it found 104,185 public copies of the file on GitHub, with the 1,122 secret-bearing files representing roughly 1.1% of that sample. The exposed material reportedly included database passwords, SSH credentials, GitHub, GitLab and npm tokens, AWS keys, an Azure PostgreSQL production password, a Square production token and an administrator-level cloud key. The researchers did not validate every credential, although at least one notified organization confirmed that a discovered key was still active.
The exposure is broader than the current contents of settings.local.json. Apiiro’s wider review of Git history, deliberately shared .claude/settings.json files and saved agent transcripts found 2,539 secrets across 1,994 repositories. That distinction matters because deleting a file from the latest branch does not remove credentials from commits, forks, cached clones or logs, and a secret embedded in a previously approved command may remain searchable long after the original file is changed.
Organizations using Claude Code should treat any credential found in these files as compromised: revoke or rotate it, inspect repository history and forks, and search for related command strings in agent transcripts and build artifacts. Developers should keep .claude/settings.local.json untracked, avoid placing secrets directly in shell commands, use environment variables or a secrets manager, and add repository-level ignore rules rather than relying only on a developer’s global Git exclusions. Anthropic’s current guidance also documents permission rules for protecting files containing API keys and other sensitive values. No CVE, public proof-of-concept or exploitation-in-the-wild report was identified in the available research; the immediate risk is accidental publication followed by credential abuse.
