Apiiro finds Claude Code settings exposed secrets on GitHub

Apiiro researchers have disclosed that Claude Code is inadvertently exposing sensitive information via public GitHub repositories due to how it stores user approval for automated shell commands. When a user selects “Yes, and don’t ask again” to approve a command, Claude Code writes a rule into a local .claude/settings.local.json file. The command itself is often left in that file, sometimes including embedded secrets.

While Claude Code notes in its documentation that this file is added to the developer’s global .gitignore, the setting is not enforced at the repository level, so the file can be uploaded or copied into other machines, or into a repository that is later shared.

Apiiro’s analysis found that Claude Code’s local settings file had been uploaded to public GitHub repositories in more than 100,000 cases, with roughly 1,100 instances across 63 organisations containing secrets such as API tokens, database passwords or private keys. Even after removal from a repository, secrets can persist in forks if users do not scrub them properly.

The findings trace back to bug reports going as far as August 2025 noting that sensitive settings sometimes were not excluded from git, or that Claude Code could relay sensitive commands to other files not protected from sharing. Apiiro highlights that a significant portion of the exposed secrets were not flagged by popular secret scanners such as gitleaks and TruffleHog.

The Claude Code team has acknowledged the issue and is exploring mitigations, including auto mode to route routine prompts and potential integration of secret scanning into Claude Code. In the interim, researchers emphasise the risk remains particularly when settings files are manually created and checked in, and note that exposure can persist via forks even after discovery.