# Claude Code settings files are leaking passwords and API keys into public GitHub repos

> Approving a command with "don't ask again" can save the full command, secrets included, to .claude/settings.local.json. Apiiro found it in 100,000+ public repos, with secrets in about 1,100.

- URL: https://devisdead.ai/news/claude-code-settings-files-are-leaking-passwords-and-api-keys-into-public-github
- Published: 2026-11-09T20:37:09Z
- Author: DevIsDead Newsroom
- Section: Dev
- Tags: claude code, security, github, secrets
- Originally reported by Ars Technica (https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/).

If you use Claude Code, check your repos today. Security researchers at Apiiro turned up thousands of credentials, from root logins to API tokens and database passwords, sitting in Claude Code settings files committed to public GitHub repositories, Kyle Orland reports for [Ars Technica](https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/).

## How it leaks

When you approve a shell command with "Yes, and don't ask again," Claude Code saves that choice as a rule in the local file `.claude/settings.local.json`. Sometimes the rule is a pattern, but often the full command goes in as written, including any password or token you typed into it.

On your own machine that's mostly fine. Anthropic's documentation says the file is added to the developer's global gitignore, which normally keeps it out of commits. But that protection doesn't live in the repository itself. Clone the repo on another machine, or turn a folder into a repo later, and the file can get committed. In many cases, Apiiro says, Claude Code commits its own edits to that file without being told to.

## The scale

Apiiro found more than 100,000 public repos containing a Claude Code local settings file. About 1,100 of them, from 63 organizations, held secrets such as API tokens, database passwords or private keys. Deleting the file afterward doesn't fully fix it: the secret can live on in forks and in Git history.

## What to do

- Add `.claude/settings.local.json` to each repository's own `.gitignore`, not just your global one.
- Search your repos and their history for the file, and rotate any credential that appears in it.
- Don't put secrets directly in shell commands you approve permanently; use environment variables or a secrets manager so the saved rule never contains the value.

It's a small design choice with a big blast radius, and a reminder that convenience features in agent tools quietly write things to disk.

**[Scoreboard](/scoreboard) update:** Humans +1. Security researchers catch an AI coding tool leaking thousands of secrets.

Stay undead.