Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, according to research from Apiiro.
How It Happens
When a user selects "Yes, and don't ask again," Claude Code saves the approved command word for word in .claude/settings.local.json inside the project. If the command contained a password or token, it is stored in plaintext.
Claude Code adds that file to the user's global git excludes, but not to the project's own .gitignore. The report says Claude sometimes commits the file itself.
Scale
- 104,185 copies of the file found in 103,617 public repositories
- 1,122 copies contain at least one secret, totaling 1,379 distinct secrets
- Including older git versions, forks and related files, the total rises to 2,539 secrets in 1,994 repositories
- Affected owners include 63 organizations
Apiiro did not test whether the secrets still work, though one notified company confirmed its key was live.
What Was Exposed
More than a third of the secrets open databases directly, including 379 database passwords. Others include 43 SSH logins, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys.
Anthropic's Response
The report notes no reply from Anthropic. An August 2025 bug report was closed as "not planned" by an automated bot, and four related reports were also closed by the bot without a response.
What Developers Should Do
- Rotate every exposed credential first, before cleaning up history.
- Search repositories and git history for
settings.local.json. - Untrack the file with
git rm --cachedand add it to.gitignore. - Delete rules that contain secrets.
- Keep secrets in a secrets manager and reference them as variables.
- Approve command patterns rather than exact commands.
What Security Teams Should Do
- Treat agent folders such as
.claude/as secret-holding. - Extend secret scanning to catch passwords embedded in commands.
- Add the file to organizational
.gitignoretemplates.