Claude Code settings files leak thousands of secrets on GitHub

The discovery of exposed secrets

Security researchers at Apiiro identified a significant security flaw involving Claude Code, the new coding tool from Anthropic. The team discovered thousands of sensitive secrets embedded within configuration files that were uploaded to public GitHub repositories. These secrets included high-value information such as database passwords, private keys, and root logins.

The scale of the oversight was notable, with researchers finding over 100,000 instances of the local settings file on public platforms. While the majority of these files did not contain sensitive data, the presence of 1,100 files containing actual secrets poses a risk to the organizations involved. These leaks can provide attackers with direct access to internal systems or private data.

The exposure is particularly concerning because it involves automated tools designed to help developers work faster. When tools automate tasks, they often handle sensitive credentials behind the scenes. As Ars Technica reported, this oversight allows private information to move from a user's local machine to a public space without the user's explicit knowledge.

How the leak occurs

The problem originates from how Claude Code handles user permissions for running automated shell commands. When a user chooses the option to approve a command and never be asked again, the tool records that choice as a rule. This rule is then saved into a local file on the user's computer named .claude/settings.local.json.

In many instances, the tool writes the entire command into this settings file as it appears. If that command contains sensitive information, such as an API token or a password, that data is saved in plain text. While this is generally safe if the file remains on a private local machine, it creates a vulnerability if the file is ever shared or moved.

The tool is designed to automatically commit changes to this settings file without requiring additional user input. This automation means that a developer might not realize the file is being modified or updated. If the file is included in a project's directory, it can be easily swept up into a public upload.

Failures in version control

Anthropic includes documentation stating that the .claude/settings.local.json file is added to a developer's global .gitignore list. A .gitignore file is a standard tool used to tell version control systems which files should not be uploaded to a repository. This is intended to keep private configuration data off of public servers.

However, the researchers found that this global setting is not always reflected at the specific repository level. This means that if a user clones a repository to a new machine or turns a folder into a repository, the settings file can be uploaded accidentally. The protection intended by the global list fails to catch the file in these specific scenarios.

Because the tool automatically commits changes, the file can be pushed to GitHub without a manual review. This creates a gap where a developer thinks they are keeping their credentials local, but the software's behavior pushes them to the cloud. It highlights a mismatch between how the tool handles local data and how it interacts with public version control systems.

Persistence and impact

The risk of these leaks extends beyond the initial upload to a public repository. Even if a developer discovers the mistake and removes the settings file from the main project, the secrets may remain. This is because GitHub allows users to create forks, which are copies of the original project that preserve the entire history of changes.

If a user is not careful, the secrets can persist in these forks indefinitely. This makes it difficult to fully scrub the information from the internet once it has been committed. Attackers can often use automated tools to scan for these specific files and extract the credentials as soon as they are pushed.

The 1,100 identified cases came from 63 different organizations, showing that this is a widespread issue across various companies. It demonstrates how easily automated developer tools can introduce security debt. Developers must be more vigilant about what information they include in commands that they authorize for repeated execution.

Best practices for developers

To prevent these types of leaks, developers should be cautious about the commands they authorize for repeated execution. If a command requires a password or a secret key, it is safer to avoid using the 'don't ask again' option. Instead, users should manually run the command each time or use environment variables that are properly excluded from version control.

It is also important to verify that local configuration files are correctly ignored by the repository's .gitignore settings. Developers should periodically audit their public repositories to ensure no local settings files have been accidentally committed. Checking for the presence of .claude/settings.local.json in public history is a good first step.

Security researchers suggest that organizations should implement automated scanning to detect secrets in their repositories. These tools can alert developers if a password or API token is pushed to GitHub. By combining these tools with a better understanding of how AI coding assistants handle local files, teams can significantly reduce their risk of exposure.