Security firm Apiiro says Claude Code's "Yes, and don't ask again" permission option has left 1,379 secrets exposed in public GitHub repositories. When a developer approves an exact command that way, Anthropic's coding agent saves the full command, including any password or token typed into it, in plain text to a project file called .claude/settings.local.json.
Apiiro found 104,185 public copies of that file across 103,617 repositories. Of those, 1,122 copies, about 1.1%, contained at least one secret. The exposed credentials included 379 database passwords, 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys, belonging to 63 organizations that are mostly software companies.
The researchers said the most serious cases included a database vendor's own admin-level cloud key and the owner password of a medical-records database. One company Apiiro notified earlier in the week confirmed its key was live. Apiiro said it did not test whether the other secrets still work, and it did not say whether any had been used.
Key facts
- 01Apiiro found 104,185 public copies of .claude/settings.local.json across 103,617 GitHub repositories.
- 021,122 of those copies held 1,379 distinct secrets, including 379 database passwords and 23 AWS keys.
- 03Counting old commits, shared settings files and agent logs, Apiiro tallied 2,539 secrets across 1,994 repositories.
- 04Of 16 coding agents compared, Claude Code was the only one confirmed to save full approved commands to a project file by default.
- 05Apiiro reproduced the behavior with Claude Opus 5.5 and Fable 5.1.
Much of the exposure is old. As of Monday, every file with a secret was still on its repository's default branch, and in half of those repositories it had been there for at least 217 days. Older commits held 734 more secrets across 509 repositories, and 211 forks of 74 repositories carry the same credentials.
Widening the search to the shared .claude/settings.json file and saved agent chat logs, Apiiro counted 2,539 secrets across 1,994 repositories in total. Standard scanners caught only part of it: gitleaks flagged 564 of the 1,122 files and TruffleHog flagged 643, while 215 were missed by both.
Claude Code does try to keep the file out of version control. Anthropic's documentation says the first time the tool writes settings.local.json in a git repository, it adds the file to the user's global git excludes. Apiiro noted that this protection lives on one developer's machine, does not touch the project's own .gitignore, and does not cover files already committed. In 539 of 1,105 repositories the researchers traced, a commit listing Claude as co-author changed the file.
Apiiro compared 16 coding agents and said Claude Code is the only one confirmed to save the full approved command in a project file by default. The researchers reproduced the behavior with Claude Opus 5.5 and Fable 5.1.
The behavior has been reported before. A Claude Code GitHub issue filed in August 2025 described approved commands with API keys and tokens being stored verbatim in settings.local.json, and a bot closed it as not planned after 60 days of inactivity. Apiiro said four related reports were closed by the same bot and none received a reply from Anthropic.
For developers, Apiiro recommends searching repositories and git history for both Claude settings files, rotating every credential those files have ever held, and removing settings.local.json from tracking with git rm --cached before adding it to the project's own .gitignore. It also advises keeping secrets out of commands by referencing variables from a secrets manager, and approving command patterns such as Bash(npm run:*) rather than single commands.
For security teams, Apiiro said agent folders including .claude, .cursor, .gemini and .specstory should be treated like .env files, added to organization .gitignore templates, and covered by pre-commit and CI secret scanning that includes git history.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
