Claude Code settings file leaks thousands of secrets on GitHub

The mechanics of the leak

Security firm Apiiro discovered that Anthropic’s Claude Code tool can leak sensitive information into public GitHub repositories. The research identified 2,539 real secrets, including 636 provider keys and 743 passwords or tokens for public hosts. These secrets were primarily found in a specific settings file named .claude/settings.local.json.

The leak happens because of how the tool handles user permissions. When a developer runs a command and selects the option to 'Yes, and don’t ask again,' Claude Code saves that exact command to the local settings file. If that command contains a password or an API key, that sensitive data is written directly into the file inside the project folder.

Apiiro noted that this is a product behavior rather than a flaw in the AI model itself. They were able to reproduce the issue using different models like Opus 5.5 and Fable 5.1. The tool is designed to keep the file local, but it fails to protect the file if it is already part of a repository or if the folder is moved into a repo later.

How secrets reach the public

While Claude Code attempts to add the settings file to a developer's global git ignore list, it does not automatically add it to the repository's specific .gitignore file. This means if a project folder is already being tracked by Git, the settings file can be committed and pushed to a public server. Apiiro found that in 539 of the 1,105 traced repositories, a commit co-authored by Claude actually changed the file.

The research also found secrets in other areas, such as shared settings.json files that teams commit intentionally and agent chat transcripts. These transcripts can include exports from other tools like aider and Cursor. The total count of 2,539 secrets includes these various sources, including earlier versions of the allowlist file.

The scope of the leak is significant for corporate security. Apiiro identified 63 organizations that held a real secret in a public allowlist, most of which were software companies. Examples of leaked data included a database vendor’s cloud API key, a production Azure Postgres password, and a Square production access token.

Limitations of security scanners

A major concern for security teams is that standard tools might not catch these specific leaks. Apiiro ran two common open-source scanners, gitleaks and TruffleHog, over 104,185 copies of the settings file. While these tools caught many secrets, they missed 215 files—about 19.2% of the total flagged by the researchers.

The reason for this gap is the nature of the data being leaked. Scanners are typically designed to look for specific key formats, such as standard API keys. However, these leaks often consist of passwords typed directly into commands. Because these do not match the standard patterns the scanners look for, they can slip through unnoticed by automated security checks.

This finding suggests that security teams cannot rely solely on automated tools to protect against AI-driven leaks. They must also consider the specific folders and files created by AI agents, such as the .claude/ directory. Monitoring for passwords inside raw command strings is necessary to catch these types of exposures.

Response and next steps

Apiiro reported the findings to the affected organizations starting on November 2, 2026. One company confirmed that their key had indeed been live on the public internet. Despite the research, Anthropic has not officially commented on the report, and users have been reporting this mechanism in GitHub issues since August 2025 without a formal reply.

The research suggests several immediate actions for developers to mitigate these risks. Apiiro advises users to untrack the .claude/ folder, rotate any credentials that may have been included in an approved command, and approve specific command patterns instead of literal commands. This prevents the tool from saving a hardcoded secret as a shortcut for future use.

For security teams, the takeaway is to treat AI agent folders as high-risk areas. They should implement custom scanning rules that look for passwords within command strings. As AI agents become more integrated into the development workflow, understanding the boundaries of what these tools record and where they store that data is essential for maintaining security.