Apiiro found 2,539 secrets in 1,994 public GitHub repositories after Claude Code saved approved shell commands—passwords and API keys included—into .claude/settings.local.json.
Shmulik Cohen and Matan Giladi published the research on 5 November 2026. Their count covers current local settings files, older copies in git history, shared .claude/settings.json files that teams commit on purpose, and some agent transcripts. Of 104,185 public copies of the local file, 1,122 held what Apiiro calls a real secret. The firm says 63 organisations were affected and that one confirmed a key had been live.
How the leak happens
Claude Code asks before it runs a shell command. Approve a one-liner that already carries a database password, cloud key or SSH login, then pick “Yes, and don’t ask again”, and the tool writes that exact command into .claude/settings.local.json as a standing allow rule. Apiiro says this is Claude Code’s own behaviour, not a quirk of one model, and that it reproduced the pattern with recent Anthropic models.
Anthropic’s settings documentation says the local file is meant for personal overrides and that Claude Code adds it to the developer’s global git excludes the first time it creates the file. That helps on one machine. It does not travel with the repository. Apiiro notes the rule never goes into the project’s own .gitignore, so a later clone, a folder that becomes a repo after the fact, or a commit that already includes the file can still publish it. In 539 of 1,105 traced repositories that held a secret, a commit co-authored by Claude changed the file.
What turned up
More than a third of the secrets in the public local files opened a database directly, Apiiro says: 379 database passwords and 122 Supabase service-role keys, plus 103 Supabase account tokens. The rest included API tokens, AI model keys, 43 SSH logins, 42 GitHub, GitLab and npm tokens, 23 AWS keys and 6 private keys. Cases on pinned commits included a database vendor’s own cloud API key, a production Azure Postgres password, a Square production token and the owner password of a medical-records database. Deleting the file does not clear history: earlier versions alone held 734 secrets in 509 repositories that no longer show a current copy.
Generic scanners miss part of the problem. Across the 1,122 files with a real secret, Apiiro says gitleaks flagged 564 and TruffleHog 643, while 215 were flagged by neither—usually passwords typed inside ordinary commands rather than keys in a known provider format. Apiiro did not test any credential or contact any host; “real secret” means a value that matched its rules and review, not proof that every key still works.
What developers should do now
Rotate any credential the file ever held, then clean the tree. Search your organisation for .claude/settings.local.json and .claude/settings.json in current trees and in history. Untrack the local file with git rm --cached .claude/settings.local.json, add it to the repository’s own .gitignore, and remove any allow rule that still contains a secret. Prefer environment variables and pattern approvals such as Bash(npm run:*) over literal commands that embed credentials. Security teams should treat agent folders the way they treat .env files and make sure scanners catch passwords inside commands.
On X, The Hacker News summarised the findings for a wide security audience after Apiiro’s post. Apiiro’s own account pointed developers at the full write-up and the same headline numbers.
Anthropic had not published a product response in the materials we checked at the time of writing. Earlier GitHub issues from Claude Code users had described related settings behaviour; Apiiro lists several that received no reply and were later closed as inactive or duplicate. Until Anthropic changes how approvals are stored, the defensive steps above are what Apiiro and secondary reports recommend for anyone who has used “don’t ask again” with secrets in the command line.
Sources
- Apiiro research: Coding Agents Are Leaking Your Secrets to GitHub (5 Nov 2026)
- The Hacker News report (7 Nov 2026)
- Anthropic Claude Code settings documentation
- Apiiro on X
- The Hacker News on X
Discover more from Sulat — AI & Tech News
Subscribe to get the latest posts sent to your email.
