Researchers at security firm Apiiro combed through public GitHub repositories, looking at Claude Code's local settings files, Git history and agent conversation logs, and found 2,539 real credentials spread across 1,994 repositories and 63 organizations. The leaked items include an Azure database password, a Square production token, SSH root login details and the owner password for a medical-records database.
The problem traces back to a button many developers click every day.
What "don't ask again" actually writes to disk
Claude Code asks for permission before it runs a shell command. If the user picks "Yes, and don't ask again," the rule is saved to .claude/settings.local.json in the project directory, and similar commands no longer trigger a prompt. The catch is that what gets saved is often the raw command. If that command contains a database connection string, an API token or a key, those values are stored in the file verbatim.
According to Anthropic's documentation, Claude Code configures Git to ignore this file when it creates it. Apiiro's findings show that safeguard fails in a number of situations: the project is cloned to another machine, an ordinary folder is turned into a Git repository later, or the file is force-added to version control. In each case, settings.local.json can be pushed along with everything else.
Apiiro reported these figures:
- There are 104,185
settings.local.jsonfiles on public GitHub, spread across 103,617 repositories. - Of those, 1,122 files (about 1.1%) contain real secrets, which come to 1,379 after de-duplication.
- Among the 1,105 repositories that could be traced, 539 show commits co-authored by Claude that modified this file.
Larger files carry more risk. Among files over 8KB, roughly one in ten hides a real key, while among files under 500 bytes it is fewer than one in 500. Permission rules pile up one by one, so the longer a user keeps clicking "don't ask again," the more the file accumulates.
Apiiro did not test whether these credentials are still valid. Even if a repository owner deletes the file, the secrets may survive in Git history and in existing forks.
Someone reported this a long time ago
On August 11, 2025, a user reported in Claude Code's issue tracker that approved commands, along with the API keys and tokens inside them, were being saved word for word into settings.local.json. That report was later closed automatically after 60 days of inactivity, and no fix followed.
More than a year later, the same mechanism has now been found through systematic scanning. Boris Cherny, who leads Claude Code, responded on Hacker News that settings files were never meant to go into version control, that the team is working on ways to prevent this, and that it is considering building secret scanning directly into Claude Code. Until then, he advised users to run a secret-scanning tool themselves and clean up. Anthropic has not said when a fix will ship.
This is also not the first time this month that Claude Code has been flagged over how it handles local data. Earlier in the month, it was pointed out that the tool attaches the user's email address to some network requests, and that time too the fix began with a mitigation, with a proper release following later. What the two cases have in common is that agentic tools write information to disk or send it out in order to interrupt users less, and developers have a hard time noticing what is actually being recorded.
What developers can do now
If you have used Claude Code, start by searching your local and remote repositories for .claude/settings.local.json and .claude/settings.json, and check whether any command in them carries a plaintext credential. Any key confirmed as exposed should be revoked and reissued; deleting the file is not enough.
A safer habit is to keep secrets out of command-line arguments and reference them through environment variables or a secrets manager instead. Turning on GitHub secret scanning or a similar pre-commit check also helps, so that files like these are caught before they are pushed.
Sources: IT Home, Apiiro research report, CocoLoop, Ars Technica, The Hacker News; figures verified for settings-file counts, share of files containing secrets, total credentials and affected organizations.