Software security firm Apiiro said 1,122 public copies of Anthropic's Claude Code project file.claude/settings.local.json on GitHub hold at least one password, token or API key, The Hacker News reported Friday¹.

The leak path, as described in the report, starts when Claude Code asks to run a shell command and the user picks “Yes, and don't ask again.” The assistant then writes an allow rule into the settings file, sometimes the full command, so matching commands skip later prompts¹. If that command included a secret in plain text, the secret is saved too¹.

Apiiro searched public GitHub and found 104,185 copies of the file in 103,617 repositories, about 1.1 percent of which (1,122 copies) held at least one secret, for 1,379 distinct secrets, The Hacker News said, citing the firm's write-up¹. A value counted as a secret when it matched a known key format or sat beside a public server address, and an AI reviewer agreed; the researchers did not test whether the secrets still work, except that one company they notified earlier this week confirmed its key had been live¹.

More than a third of the secrets open a database directly, including 379 database passwords, the report said¹. Others include 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys¹. Among owners were 63 organizations, mostly software companies; Apiiro described as strongest cases a database vendor's admin-level cloud key and the owner password of a medical-records database¹.

As of Monday, every file with a secret was still on its repository's default branch, and in half of those repositories it had been there for at least 217 days, according to the account¹. Older versions held 734 more secrets across 509 repositories where the current copy no longer has them, usually because the file was deleted¹. Forks spread the same secrets further: 211 forks of 74 repositories, the researchers said¹.

Claude Code tries to keep the local settings file out of git by adding it to the user's global git excludes the first time it writes the file in a repository, The Hacker News said, citing Anthropic documentation¹. That ignore setting stays on one computer and does not travel with the project, and Claude Code does not add the file to the project's.gitignore, Apiiro said¹. In 539 of 1,105 repositories the researchers traced, a commit listing Claude as a co-author changed the file¹.

Including 298 of 76,011 public copies of the shared.claude/settings.json file, older versions, and saved agent chat logs, Apiiro's total was 2,539 secrets across 1,994 repositories¹. Of 16 coding agents whose documentation the researchers compared, Claude Code was the only one confirmed to save the full approved command in a project file by default¹.

Common scanners missed many of the files: without verification, gitleaks flagged 564 of the 1,122 secret-bearing copies and TruffleHog 643, and neither flagged 215, mostly passwords inside ordinary command lines, the report said¹.

Apiiro advised organizations to search GitHub and git history for the files, rotate every credential they have ever held before cleanup, stop tracking the local file, add it to the project's.gitignore, and approve command patterns rather than exact commands that contain secrets¹. Users had reported the storage behavior in GitHub issues starting Aug. 11, 2025; as of the article, four related reports cited by the researchers had been closed by an automated bot, the most recent the day before publication, with no reply from Anthropic, they said¹. Anthropic's response was not in The Hacker News account¹.

Sources

1. The Hacker NewsClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub1:44 AM

Read the original at The Hacker News ↗