VULNpocalypse
HighEcosystem changeActive

Claude Code settings.local.json leaks secrets to public GitHub repos

Claude Code can save approved commands with secrets in .claude/settings.local.json, found in public GitHub repos; rotate any credential it ever held.

Published
Updated
Exploitation
No public evidence of use; researchers do not say whether anyone used the secrets, though one notified company confirmed its key had been live

What happened

When a Claude Code user answers a command prompt with “Yes, and don’t ask again”, the tool saves an allow rule in .claude/settings.local.json inside the project. When that rule is the exact command rather than a pattern, any password or token typed into it is stored in plain text, The Hacker News reports, citing research by software security company Apiiro. Apiiro reproduced the behavior with the latest models, Opus 5.5 and Fable 5.1, according to the same report.

Claude Code adds the file to the user’s global git excludes the first time it writes it in a git repository, but it never adds it to the project’s own .gitignore, so the protection does not travel with the project and does nothing for files already committed (The Hacker News). Cyber Security News adds that it may not reliably protect a folder turned into a repository later. In 539 of the 1,105 repositories traced, a commit listing Claude as a co-author changed the file, which the researchers take to mean Claude often commits it itself (The Hacker News).

Apiiro’s findings, as reported:

  • 104,185 copies of the file in 103,617 public repositories; about 1.1%, or 1,122 copies, hold at least one secret, totalling 1,379 distinct secrets (The Hacker News).
  • GBHackers breaks these into 636 provider-format keys and 743 passwords or tokens associated with public hosts.
  • 379 database passwords, 43 SSH logins, 42 GitHub, GitLab and npm tokens, and 23 AWS keys (The Hacker News). Cyber Security News also lists 122 Supabase service-role keys. GBHackers adds 103 Supabase account tokens and six private keys.
  • Older file versions hold 734 more secrets across 509 repositories, and 211 forks of 74 repositories carry the same secrets. Including the shared .claude/settings.json file (298 of 76,011 copies) and saved agent chat logs, the total is 2,539 secrets across 1,994 repositories (The Hacker News).
  • 63 organizations were affected, mostly software companies. Examples include a database vendor’s admin-level cloud key and the owner password of a medical-records database (The Hacker News). Cyber Security News also names a production Azure PostgreSQL password and a Square production token.

Apiiro did not test whether the secrets still work. One company the researchers notified confirmed its key had been live (The Hacker News). GBHackers says Apiiro did not test credentials or contact hosts, and that its “real secret” label means credible credential material, not verified validity. The researchers do not say whether anyone has used these secrets (The Hacker News).

Outlets differ on the research date. GBHackers dates it November 5. The Hacker News says “yesterday” in a November 7 article. Cyber Security News says collection took place November 1 to 3, 2026.

Common scanners miss many of these files. Of the 1,122 files, gitleaks flagged 564 and TruffleHog 643, and neither flagged 215. These scans were run without the tools’ verification step, and most misses were passwords typed after PGPASSWORD=, sshpass -p or mysql -p (The Hacker News).

An earlier bug report filed on August 11, 2025 described the same behavior. The four related reports the researchers cite were all closed by an automated bot, and none got a reply from Anthropic, according to the researchers (The Hacker News). A fix is not confirmed.

Am I affected?

You may be affected if you approved Claude Code commands with “Yes, and don’t ask again” while the command contained a literal password, token or key. Your exposure is public if .claude/settings.local.json or .claude/settings.json was ever committed to a public repository, including in history or in forks (The Hacker News).

Deleting the file does not undo the leak, because older versions stay in git history and forks. Uncommitted copies still matter: the file can end up in an npm package, a Docker image, a zip archive or a synced folder (The Hacker News). The plain-text file can also be read by malware on a compromised laptop. Both The Hacker News and Cyber Security News note that the Shai-Hulud worm used TruffleHog to search developer files for secrets.

What to do now

These steps come from the researchers, as reported by The Hacker News and Cyber Security News.

  1. Search your GitHub organization for .claude/settings.local.json and .claude/settings.json, and check git history for them, even where the files are gone.
  2. Rotate every password, token and key the files have ever held, before deleting files or rewriting history.
  3. Stop tracking the local file with git rm --cached .claude/settings.local.json and add it to the repository’s own .gitignore.
  4. Open the file on your own computer, even if it was never committed, and delete every rule that contains a secret.
  5. Keep secrets out of commands: reference them as variables from a secrets manager, such as $DB_URL, and approve patterns such as Bash(npm run:*) instead of single commands.
  6. For security teams: treat agent folders such as .claude/, .cursor/, .gemini/ and .specstory/, plus agent memory files, like .env files. Add them to pre-commit and CI secret scanning, including history, with checks for passwords inside commands. Add .claude/settings.local.json to organization .gitignore templates, and check credentials paired with a public server first.

Update, 8 November 2026

  • Kyle’s Investigation names the Apiiro researchers as Shmulik Cohen and Matan Giladi. (kylesinvestigation.com)
  • Kyle’s Investigation says more than a third of the 1,379 secrets gave direct access to a database. (kylesinvestigation.com)
  • Kyle’s Investigation says a developer who force-adds the file, uses a different machine, or works from a fresh clone can commit it without any warning. (kylesinvestigation.com)
  • Kyle’s Investigation says Apiiro also found secrets in deployment notes, in addition to saved agent conversations and memory files. (kylesinvestigation.com)
  • Kyle’s Investigation says the Apiiro research was published November 5, 2026. (kylesinvestigation.com)

Update, 9 November 2026

  • The Hacker News says that as of Monday every file containing a secret was still on its repository’s default branch, and in half of those repositories it had been there for at least 217 days. (thehackernews.com)
  • The Hacker News says that of 16 coding agents whose documentation the researchers compared, Claude Code is the only one confirmed to save the full approved command in a project file by default. (thehackernews.com)
  • The Hacker News says a value counted as a secret when it matched a known key format, or when a password or token sat beside the address of a public server, and an AI reviewer also had to agree. (thehackernews.com)
  • The Hacker News says an automated bot closed the August 11, 2025 bug report as “not planned” on January 3, after 60 days without activity, and the most recent of the four related reports was closed the day before the article. (thehackernews.com)

Sources