Anthropic's Claude Code has been accidentally exposing sensitive developer data on public GitHub repositories, according to security researchers at Apiiro. The problem comes from the way the coding assistant stores approved shell commands inside a local settings file.
Apiiro found more than 100,000 cases where Claude Code's local settings file had been uploaded to a public GitHub repository. About 1,100 of those files, from 63 different organizations, contained real secrets including public API tokens, database passwords and private keys.
How Claude Code leaks credentials
When a developer approves an automated shell command in Claude Code and picks "Yes, and don't ask again," that approval is saved as a rule in a file named .claude/settings.local.json on the local machine. The rule is sometimes stored as a pattern, but the command itself is often written into the file exactly as it was run, including any passwords or tokens inside it.
Anthropic's documentation says this file is added to the developer's global .gitignore list, which normally keeps it out of version control. However, that protection is not reflected at the repository level. As a result, the file can be uploaded by accident if a repository is cloned to another machine or if a folder becomes a repository later.
Apiiro also notes that Claude Code itself may commit changes to the settings file without user input, making the leak easy to miss. Even after a file is deleted from a repository, secrets can survive in forks of the original project.
Anthropic's response and the bug reports
The issue was reported in a Claude Code bug report as far back as August 2025, according to Ars Technica. Other reports noted the same file was sometimes not added to a user's .gitignore list, or that sensitive commands were written to another unprotected file. Those reports were closed after 60 days of inactivity.
Claude Code's Boris Cherny said on Hacker News that the team is looking into what it can do to prevent the problem. He added that these settings files should almost never be checked into source control, and that cases like these seemed to appear only when files were manually created and checked in.
Cherny recommended the tool's auto mode, which uses classifiers to route routine permission prompts, and also suggested that users run secret scanners. He said the team is considering building secret scanning directly into Claude Code. Apiiro's findings suggest scanners are not a full fix: 215 of the roughly 1,100 exposed secrets were not flagged by gitleaks or TruffleHog.
