Anthropic’s Claude Code is a tool that lets developers run AI‑generated shell commands inside their projects. When a user clicks “Yes, and don’t ask again,” the approval is saved in a local file called .claude/settings.local.json. The file holds the exact command, which can include database passwords, API tokens or other credentials. Anthropic’s documentation says the file is added to a global .gitignore, so it should stay on the developer’s machine.
Researchers at Apiiro discovered that the .gitignore entry does not apply to the repository itself. If a folder containing the settings file is later turned into a Git repository, or if Claude Code itself commits the file, the sensitive data can be pushed to GitHub. Apiiro’s scan of public GitHub repositories uncovered more than 100,000 instances of the file, and about 1,100 of those contained actual secrets. The secrets came from 63 different organizations and included public API tokens, database passwords and private keys.
Once a file is public, removing it from the main repository does not erase it from forks or cached copies. That means anyone who clones the repo or browses its history can still see the leaked credentials. The researchers warned that the exposure could allow attackers to access databases, cloud services or internal systems if the leaked keys are still active.
Why the leak matters
For developers, the finding highlights the need to double‑check what files are being tracked before committing code. Relying on a global .gitignore alone is not enough; each repo should have its own .gitignore that excludes .claude/settings.local.json. Organizations should also rotate any credentials that may have been exposed and scan their repos for similar files.
Why it matters
Developers may unintentionally expose credentials when using Claude Code, leading to potential unauthorized access to services. Organizations must audit their repositories and treat the settings file as sensitive, adding it to each project's .gitignore and rotating any leaked keys.
