Apiiro finds secrets exposed in 1,122 public Claude Code files

Apiiro researchers found that passwords and API keys typed into commands approved in Claude Code’s “don’t ask again” workflow have been stored in public GitHub repositories. The leak centres on the file .claude/settings.local.json, which, when a user selects “Yes, and don’t ask again,” saves the command and any secret in plain text. Apiiro says 1,122 public copies of that file across 1,105 repositories contained at least one secret, though it did not test whether the credentials are still valid.

Their analysis tallied a total of 1,379 secrets within those copies; among them are 379 database passwords, 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. Some owners include 63 organisations, spanning software firms of various sizes, with examples such as a database vendor’s admin-level cloud key and a medical-records database password.

The researchers note that, in many cases, the secret persisted in the repository history or forks, so removing the file from the current project does not eliminate the leak.

Claude Code’s own documentation explains that the tool attempts to keep the file out of git by adding it to the user’s global git excludes on first write, but this protection only affects the local device and not any past commits. Apiiro’s wider sweep of public GitHub found 104,185 copies of the file in 103,617 repositories, with about 1.1 per cent containing secrets. The researchers also observed that, in older versions, a further 734 secrets across 509 repositories existed, not present in current copies.

They advise organisations to search for both .claude/settings.local.json and .claude/settings.json, rotate every credential ever stored in those files, stop tracking the local file with git rm --cached, and add the file to the repository’s .gitignore.