A single click meant to save time has left thousands of passwords and API keys sitting in public GitHub repositories. Security firm Apiiro reported this week that Anthropic's Claude Code, when told "Yes, and don't ask again" for a shell command, saves that command word for word — secrets included — into a project settings file. If the file is committed and pushed, the credentials go public along with the code.
The scale of the exposure is striking. Apiiro scanned 104,185 public copies of the file, .claude/settings.local.json, across 103,617 repositories and found 1,122 files holding at least one secret — 1,379 distinct credentials in total. Counting older commits, shared settings files and saved agent transcripts, the total rises to 2,539 secrets across 1,994 public repositories, affecting 63 organisations, mostly software companies. One company the researchers notified confirmed that its exposed key had still been live.
What was exposed
Database access dominated the haul: 379 database passwords, 122 Supabase service-role keys and 103 Supabase account tokens. The scan also turned up 43 SSH logins for public servers — some of them root logins embedded in sshpass commands — plus 23 AWS keys and six private keys. Among the examples Apiiro cited were a production Azure PostgreSQL password, a Square production token and the owner password for a medical-records database.
The exposure was not brief. In half of the affected repositories the file had sat on the default branch for at least 217 days, and older versions of the file held 734 more secrets across 509 repositories that no longer appear in current copies. Deleting the file does not undo the leak, because git history and forks keep the old versions. In 539 of 1,105 traced repositories, Claude Code itself appears to have committed the file.
Why the usual scanners missed it
Standard secret scanners struggled with the format. Gitleaks flagged 564 of the 1,122 secret-bearing files and TruffleHog caught 643 — but 215 escaped both tools, because passwords in commands such as PGPASSWORD= or sshpass -p often lack the recognisable prefixes scanners look for. Apiiro stressed that it did not test the credentials or contact the hosts, so its count reflects credible credential material rather than confirmed live secrets — and there is no public evidence that any of them were actually used.
A warning filed more than a year ago
The flaw is not new. A GitHub issue filed on August 11, 2025 reported that approved commands containing API keys and tokens were being stored word for word in the settings file. Apiiro cited four related reports, all closed by an automated bot — the most recent only yesterday. Anthropic's own documentation confirms that standing approvals are saved in the local settings file, and Claude Code does try to protect it, adding the file to the developer's global gitignore when it creates one inside an existing repository. That protection does not cover files already being tracked, repositories initialised later, or clones on another workstation.
Apiiro's advice is blunt: search your organisation's GitHub for .claude/settings.local.json and .claude/settings.json, check each repository's git history for them, and rotate anything you find. For a tool built to move fast, the lesson is an old one — a convenience feature that remembers what you typed will remember the secrets too.
