Claude Code stores user-approved shell commands in a local file named .claude/settings.local.json. When a user selects the “Yes, and don’t ask again” option, the exact command,often containing passwords, API tokens, or other credentials,is written verbatim into this JSON file, creating a persistent record of the sensitive instruction on the developer’s machine.
Anthropic’s documentation notes that the settings file is automatically added to a global .gitignore, which normally prevents it from being tracked by version control. However, the ignore rule is not applied at the repository level, so if a directory containing the file is later initialized as a Git repository or cloned elsewhere, the file can be unintentionally added to a public commit.
Further complicating matters, Claude Code sometimes commits changes to the settings file on its own, without prompting the user. Researchers at Apiiro observed that the tool can push updates to the JSON file automatically, increasing the likelihood that any embedded secrets are propagated to remote repositories without explicit consent.
Apiiro’s analysis uncovered more than one hundred thousand instances where the settings file appeared in public GitHub repositories. Of those, roughly 1,100 files from 63 distinct organizations actually contained exploitable secrets such as public API tokens, database passwords, or private cryptographic keys, and the leaked data can survive in forks even after the original repository is cleaned.
The problem was first reported in a Claude Code bug ticket in August 2025, and subsequent reports highlighted that the file was sometimes omitted from the user’s .gitignore or written to alternative, unprotected files. All of these tickets were closed after sixty days of inactivity, leaving the underlying vulnerability unaddressed.
Security researcher Cherny advises users to run secret-scanning tools on their codebases and notes that Anthropic is evaluating native scanning capabilities for Claude Code. Nonetheless, Apiiro found that 215 of the approximately 1,100 public secrets escaped detection by two widely used scanners, gitleaks and TruffleHog, indicating gaps in existing tooling.
Claude Code is not the only AI system to inadvertently expose data. Last month, Meta disabled the sharing feature of its Muse agent after researchers demonstrated that the generated URLs could be guessed, underscoring a broader pattern of AI-driven tools leaking sensitive information when safeguards are insufficient.