AI Coding Assistant Claude Code Leaks Passwords and API Keys via Project Settings Files

Passwords, database credentials, and sensitive API keys typed by developers into commands approved within Anthropic’s AI coding assistant, Claude Code, are inadvertently sitting exposed in public GitHub repositories where anyone can read them.

The security oversight stems from a specific feature in the AI assistant. When a user selects the "Yes, and don’t ask again" prompt option, Claude Code can save the approved command word-for-word—including any hardcoded secrets—directly into a local project settings file. Software security firm Apiiro revealed yesterday that an extensive scan of public GitHub repositories uncovered 1,122 public copies of this configuration file holding at least one active or historical secret. While researchers did not actively test whether every discovered credential remained functional, one corporate victim notified earlier this week confirmed that its exposed key was indeed live and operational at the time of discovery.

The file at the center of the security issue is named .claude/settings.local.json. According to security experts, simply deleting this file from a project directory does not remediate the leak because older iterations of the file remain permanently preserved within git history and public forks of the repository. Consequently, researchers advise affected teams to prioritize credential rotation first—modifying every password, token, and API key that the file has ever housed—before undertaking repository cleanup operations.

How Secrets End Up in Configuration Files

By default, Claude Code is designed to prompt developers for explicit permission before executing most shell commands. However, to streamline workflows, users are frequently offered the convenience of selecting a persistent approval option labeled "Yes, and don’t ask again." According to Anthropic’s official permissions documentation, this selection writes an allow-rule into the .claude/settings.local.json file located inside the project directory. Once recorded, matching commands bypass manual confirmation prompts in subsequent coding sessions.

The scope of these automated rules depends entirely on what the AI prompt initially offered. In some instances, the rule saves a broad pattern, such as running npm test *. In other scenarios, it records one exact command string verbatim. When the exact command contains sensitive inputs—such as inline database passwords, private authentication tokens, or cloud service keys typed directly into the terminal—those credentials are persistently saved in plain text within the JSON file.

During their investigation, researchers successfully reproduced this exact behavior using the latest iteration of Anthropic’s underlying models, specifically Opus 5.5 and Fable 5.1.

To mitigate local exposure, Claude Code attempts to keep the file out of version control systems. Its settings documentation states that the first time the tool generates the file within a git repository, it automatically appends the filename to the user’s global git excludes configuration. In theory, Git on that specific developer workstation should then ignore the file across every local repository.

However, security analysts point out a critical flaw in this safeguard: the protection applies strictly to a single user’s global git settings on one machine. It offers zero protection for files that have already been committed to a repository. Furthermore, Claude Code never adds the settings file to a project’s native .gitignore file, meaning the exclusion rule does not travel with the project when it is shared, cloned, or pushed by other team members. In fact, in 539 of the 1,105 repositories analyzed by researchers, a commit listing Claude itself as a co-author had actively modified the file, indicating that the AI assistant frequently commits the configuration file to version control autonomously.

Findings From Apiiro’s Security Audit

Apiiro’s comprehensive automated scan of public GitHub repositories revealed 104,185 total copies of the .claude/settings.local.json file dispersed across 103,617 unique repositories. Approximately 1.1% of those copies—totaling 1,122 files—contained at least one secret, amounting to 1,379 distinct sensitive credentials in total.

Researchers classified a string as a secret if it matched known cryptographic key formats, or if a password, token, or private string sat in proximity to a public server address. Additionally, an automated AI reviewer was utilized to validate the classifications. The exposed material covers a broad spectrum of high-value targets. More than a third of the discovered secrets provide direct database access, including 379 plaintext database passwords. The dataset also includes 43 SSH login credentials for public servers, 42 authentication tokens for platforms like GitHub, GitLab, and npm, and 23 Amazon Web Services (AWS) keys.

The impact extends across numerous corporate entities, with researchers identifying files belonging to 63 distinct organizations ranging from small tech startups to large enterprises. Among the most concerning instances uncovered are an admin-level cloud key belonging to a database vendor and an administrative owner password protecting a medical records database.

As of early this week, every single configuration file containing a secret remained publicly accessible on its repository’s default branch. In half of those affected repositories, the exposed files had been lingering on the main branch for at least 217 days.

The scope of exposure widens further when examining historical data and repository forks. Older versions of the configuration files harbor an additional 734 secrets across 509 repositories that do not appear in current copies, typically because the file was subsequently deleted without purging git history. Code forks compounded the problem, with 211 forks originating from 74 distinct repositories carrying the exact same secrets found in the parent projects.

Additionally, researchers discovered secrets embedded within 298 out of 76,011 copies of the shared .claude/settings.json file, which development teams frequently commit intentionally as part of their collaborative workflow, usually within broader allow-rules. When combining the local settings files, historical git versions, shared configurations, and saved AI agent chat logs, the total count reaches 2,539 secrets distributed across 1,994 distinct repositories.

When comparing Claude Code against 15 other prominent coding agents and their respective documentation, researchers confirmed that Claude Code is currently the only tool known to store full, unredacted approved commands within a project configuration file by default.

Broader Risks and Detection Challenges

The risks associated with exposed configuration files extend well beyond public code hosting platforms. Security experts emphasize that local copies that never reach GitHub still pose a severe internal threat. Because the file is stored as plain JSON directly inside the project folder, it can easily be bundled into published npm packages, built into Docker container images, compressed into zip archives, or synchronized across cloud storage directories.

Malicious threat actors have increasingly targeted developer workstations specifically to harvest stored credentials. In September 2025, the automated Shai-Hulud malware worm scanned compromised computers using the TruffleHog secret-scanning utility, subsequently flagging more than half of the discovered developer configuration files as containing actionable secrets.

Compounding the problem, standard enterprise secret-scanning tools frequently fail to catch these specific leaks. When researchers ran popular open-source scanners like Gitleaks and TruffleHog over every discovered copy without their verification steps enabled, the tools showed significant blind spots. Out of 1,122 files confirmed to hold a secret, Gitleaks successfully flagged only 564, while TruffleHog detected 643. A total of 215 compromised files were missed entirely by both tools.

Most of these detection failures occur because standard scanners are tuned to recognize formalized API key patterns, whereas passwords typed directly into command-line arguments—such as strings following parameters like PGPASSWORD=, sshpass -p, or mysql -p—frequently blend in as ordinary words within standard shell commands, bypassing automated filters.

Previous Reports and Response History

This security behavior is not entirely new to the development community, as users of Claude Code have previously raised concerns regarding how the assistant handles command persistence. An earlier bug report was formally filed on GitHub on August 11, 2025, detailing how approved shell commands containing embedded API keys and authentication tokens were being stored verbatim inside settings.local.json.

That initial report languished without direct developer engagement for months before an automated moderation bot closed the issue as "not planned" on January 3 following a 60-day period of inactivity. According to researchers, four separate related bug reports filed on the repository have all met the same fate, having been systematically closed by the automated bot without any official response from Anthropic representatives.