Apiiro finds Claude Code secrets in 1,122 GitHub files

Apiiro counted 2,539 real secrets in 1,994 public GitHub repositories, sitting in Claude Code settings files and agent transcripts, its researchers Shmulik Cohen and Matan Giladi wrote on November 5. A password typed inline into a command approved with “Yes, and don’t ask again” is saved in plaintext in .claude/settings.local.json, and no Claude Code release through 2.1.319, published November 6, has changed that.

Per Claude Code’s docs, the option stores the approval as an allow rule in that project-local file, so the command runs unprompted next time. The rule is either the exact command or a prefix the dialog offers, and the secret leaks whenever it sits inside the saved text, as in PGPASSWORD=... psql -h host. Of 16 coding agents whose docs Apiiro compared, Claude Code is the only one confirmed to write the full approved command to a project file by default.

Current copies of that file account for 1,122 of the leaks, including 379 database passwords and 43 SSH logins; another 734 secrets, in 509 repos, survive only in earlier versions of it. Of the 1,122 files, 215 slipped past both gitleaks and TruffleHog. Apiiro tested none of the credentials, though one company it notified confirmed its key had been live.

Boris Cherny of the Claude Code team wrote on Hacker News that Claude Code “has not done secret scrubbing” historically and that the team is “looking into what we can do to prevent this.” Claude Code gitignores the file when it creates it, he said, “so in this case the files were manually created and checked in.” Apiiro traced 1,105 repos with a real secret: in 539 of them, a commit co-authored by Claude changed the file, naming models from Sonnet 4.5 to Opus 5.5.

Where the excludes entry goes

Apiiro advises approving patterns such as Bash(npm run:*) instead of literal commands; Cherny’s advice is that “everyone should be using auto mode instead.”

Per the docs (documented, not measured by us), the first time Claude Code writes the file in a git repository that doesn’t already ignore it, it adds **/.claude/settings.local.json to core.excludesFile when your global git config sets that to an absolute or ~ path, otherwise to $XDG_CONFIG_HOME/git/ignore, or to ~/.config/git/ignore when that variable is unset. A folder that becomes a repo later gets no entry, Apiiro notes, so a project that started outside git needs the line added by hand.