# Claude Code settings files expose thousands of secrets on GitHub

> Security researchers found over 100,000 public Claude Code setting files on GitHub, 1,100 of which contained passwords, API keys and private keys.

Oossa · 2026-11-09 · https://oossa.com/en/claude-code-settings-files-expose-thousands-of-secrets-on-github

Anthropic’s Claude Code is a tool that lets developers run AI‑generated shell commands inside their projects. When a user clicks “Yes, and don’t ask again,” the approval is saved in a local file called .claude/settings.local.json. The file holds the exact command, which can include database passwords, API tokens or other credentials. Anthropic’s documentation says the file is added to a global .gitignore, so it should stay on the developer’s machine.

Researchers at Apiiro discovered that the .gitignore entry does not apply to the repository itself. If a folder containing the settings file is later turned into a Git repository, or if Claude Code itself commits the file, the sensitive data can be pushed to GitHub. Apiiro’s scan of public GitHub repositories uncovered more than 100,000 instances of the file, and about 1,100 of those contained actual secrets. The secrets came from 63 different organizations and included public API tokens, database passwords and private keys.

Once a file is public, removing it from the main repository does not erase it from forks or cached copies. That means anyone who clones the repo or browses its history can still see the leaked credentials. The researchers warned that the exposure could allow attackers to access databases, cloud services or internal systems if the leaked keys are still active.

## Why the leak matters

For developers, the finding highlights the need to double‑check what files are being tracked before committing code. Relying on a global .gitignore alone is not enough; each repo should have its own .gitignore that excludes .claude/settings.local.json. Organizations should also rotate any credentials that may have been exposed and scan their repos for similar files.

## The facts

- Apiiro found over 100,000 public .claude/settings.local.json files on GitHub.
- About 1,100 of those files contained real secrets such as API tokens, database passwords and private keys.
- The secrets came from 63 different organizations.
- Claude Code automatically commits changes to the settings file without asking the user.
- Anthropic says the settings file is added to a global .gitignore, but that does not prevent it from being uploaded to a repository.

## Why it matters

Developers may unintentionally expose credentials when using Claude Code, leading to potential unauthorized access to services. Organizations must audit their repositories and treat the settings file as sensitive, adding it to each project's .gitignore and rotating any leaked keys.

## Sources & references

1. [Claude Code settings files expose thousands of secrets on GitHub](https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/) – Ars Technica, 2026-11-09

Last updated: 2026-11-09