Software security firm Apiiro said public GitHub copies of Anthropic’s Claude Code project settings file contain passwords, API keys and other credentials that developers approved when they chose not to be asked again^1,2.

The researchers said 1,122 of 104,185 public.claude/settings.local.json files, in 103,617 repositories, held at least one secret, totaling 1,379 distinct secrets^1,2. They reported notifying affected organizations on Nov. 2 and 3, 2026, and said one company confirmed a key had been live².

By default, Claude Code asks before running most shell commands¹. If a user selects “Yes, and don’t ask again,” the tool writes an allow rule in.claude/settings.local.json^1,2. When the rule is an exact command rather than a pattern, any password or token in that command is stored in plain text^1,2. Apiiro said it reproduced the behavior with Anthropic’s latest models, including Opus 5.5 and Fable 5.1^1,2.

Claude Code tries to keep the file out of git by adding it to the user’s global git excludes the first time it is written in a repository, according to Anthropic’s settings documentation as cited by both reports^1,2. That setting stays on one computer and is not added to the project’s.gitignore, so it does not travel with clones or later commits^1,2. In 539 of 1,105 repositories the researchers traced, a commit listing Claude as a co-author changed the file^1,2.

More than a third of the secrets opened a database directly, including 379 database passwords, the researchers said^1,2. Other counts included 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys^1,2. They said 63 organizations, mostly software companies, owned files with secrets^1,2. As of Nov. 2, 2026, every file with a secret still sat on its repository’s default branch, and in the median such repo the file had been committed for at least 217 days^1,2.

Deleting the current file does not clear git history or forks^1,2. Older versions held 734 additional secrets across 509 repositories that were not in any current copy, and 211 forks of 74 repositories carried the same secrets^1,2. Counting history, the shared.claude/settings.json file teams commit on purpose, and saved agent chat logs, Apiiro’s total was 2,539 secrets across 1,994 repositories^1,2.

Of 16 coding agents whose documentation the researchers compared, Claude Code was the only one confirmed to save the full approved command in a project file by default^1,2. Common scanners missed many cases: of 1,122 files with a secret, gitleaks flagged 564 and TruffleHog 643, and neither flagged 215, often because a password sat inside a command rather than a known key format^1,2.

Apiiro recommended rotating every credential the files had ever held, then untracking the local file, adding it to the repo.gitignore, and approving patterns instead of literal commands with secrets^1,2. Users had reported the storage of approved commands with tokens in GitHub issues as early as August 2025; the researchers said related reports were closed by an automated bot without a reply from Anthropic^1,2. Anthropic’s response, if any, was not in the two reports^1,2.