A feature in Claude Code is leaking passwords and API keys to public GitHub repositories. When developers use the "don't ask again" button, the agent saves commands containing sensitive credentials into a settings file. Researchers at Apiiro found these secrets in over 1,100 public repositories, creating major security risks.

Serving tech enthusiasts for over 25 years.

TechSpot means tech analysis and advice you can trust.

Facepalm: A feature in Claude Code meant to save developers a few clicks is exposing database passwords, API tokens and private keys in public GitHub repositories. When a developer tells Anthropic's coding agent to stop asking for permission to run a shell command, the agent saves the exact command, along with any credentials inside it, to a settings file in the project folder. Researchers at security firm Apiiro found that file in more than 100,000 public repositories, and about 1,100 of them contained secrets.

Claude Code asks for approval before it runs shell commands on a developer's machine. One of the options is "Yes, and don't ask again." Choosing it creates an allow rule in a file called .claude/settings.local.json. Sometimes the rule is a general pattern, but often it's the full command, stored word for word. If that command included a password, a token or a root login, the credential now sits in plain text in a JSON file inside the project directory.

Anthropic's documentation says Claude Code adds an entry for this file to the developer's global Git ignore configuration. That normally keeps Git from tracking it. But a global ignore list lives in the developer's own Git configuration, not in the repository. If the repository is cloned to a different machine, or if a folder that already holds the file is turned into a repository later, that protection may not be in place. Apiiro also reports that Claude Code often commits changes to the settings file on its own, without the user taking any action.

The exposed secrets Apiiro found came from 63 organizations. They included API tokens, database passwords, private keys and root logins. Deleting the file from a repository does not fully solve the problem. If someone forked the project before the cleanup, the credentials remain in that fork.

Developers usually rely on secret scanners to catch this kind of mistake, but scanners didn't catch everything here. Of the roughly 1,100 exposed secrets, 215 were not flagged by either gitleaks or TruffleHog, two widely used open-source scanners. That is close to one in five.

The problem had already been reported. A bug filed in Anthropic's Claude Code GitHub repository in August 2025 described it. Later reports said the settings file was sometimes not added to .gitignore at all, and that Claude Code could write sensitive commands to a different file that had no protection from Git. All of those reports were closed automatically after 60 days without activity, with no fix.

Boris Cherny of the Claude Code team discussed the findings in a Hacker News thread over the weekend. He said the team is "looking into what we can do to prevent this." He also said these settings files should almost never be checked into source control, and that the cases appeared when "the files were manually created and checked in."

Cherny pointed users to Claude Code's auto mode, which uses classifiers to handle "routine permission prompts" instead of relying on what he called "manually maintaining finicky allow/deny lists." Another commenter replied that auto mode can still save sensitive commands to the settings files. Cherny called it a "good catch" and said the team is "thinking through what we can do to improve this."

He also advised developers to use secret scanners, and said the team is considering building secret scanning into Claude Code itself. Apiiro's results suggest that would be a partial fix at best, since the two leading open-source tools missed 215 of the exposed credentials.

The underlying design issue is that the permission system stores raw command strings. For an agent that writes and runs shell commands on its own, those strings will often contain credentials. Any fix that leaves those strings unchanged on disk still depends on ignore rules working correctly on every machine and in every repository setup.

Claude Code is not the only AI agent to leak user data recently. Last month, Meta suspended the sharing feature in its Muse agent after security researchers found that the URLs for shared conversations could be easily guessed.