A button meant to save developers time has left passwords, cloud keys and access tokens sitting in public code on GitHub, according to new research from security firm Apiiro.
The problem centers on Claude Code, Anthropic's AI coding assistant. Before it runs a shell command, the tool asks for permission. One of the answers is "Yes, and don't ask again." Choosing it saves a standing rule in a file called .claude/settings.local.json inside the project folder, so the same command can run without a prompt next time.
Sometimes that rule is a general pattern. Often, Apiiro found, it is the exact command the developer approved. If that command carried a database password or an API token, the secret is saved too, in plain text.
How the file ends up public
Anthropic's documentation says the file is meant to stay on the developer's computer. The first time Claude Code writes it inside a git repository, it adds the file to the user's global git ignore list, which keeps it out of commits on that machine.
Apiiro says that protection has gaps. It does not travel with the project, because the file is never added to the repository's own ignore list. It does not cover a folder that becomes a repository later, a fresh clone on another machine, or a file that was already committed. In 539 of the 1,105 repositories with a real secret that the researchers traced, a commit listing Claude as a co-author had changed the file.
The researchers searched public GitHub from Nov. 1 to Nov. 3. They found 104,185 copies of the file in 103,617 repositories. Of those, 1,122 files, about 1.1%, held what Apiiro calls a real secret, for 1,379 distinct secrets in all.
More than a third open a database directly, according to Apiiro, including 379 database passwords. The files also held 43 SSH logins for public servers, some with root passwords, plus 42 GitHub, GitLab and npm tokens and 23 AWS keys. Apiiro said 63 organizations were among the owners, from student groups and startups to software agencies and established vendors. The worst cases included a database vendor's own cloud key and the owner password for a medical-records app's database.
Deleting the file does not end the exposure. Apiiro found 734 more secrets in 509 repositories that existed only in older versions of the file, and 211 forks of 74 repositories carried the same secrets as the originals. Counting git history, a shared settings file that teams commit on purpose, and saved agent chat logs, the total came to 2,539 secrets across 1,994 public repositories.
Common scanning tools missed many of them. Of the 1,122 files with a secret, gitleaks flagged 564 and TruffleHog flagged 643, and neither caught 215, according to Apiiro. The firm said most misses were passwords typed inside ordinary command lines, which do not look like known key formats.
Apiiro said it did not use or test any of the credentials, so it is not known how many still work. But one organization it notified confirmed that its exposed key had been live. Apiiro said it contacted the affected organizations on Nov. 2 and 3 and shared the research with Anthropic before publishing on Nov. 5. Apiiro sells application and AI-agent security products, and its figures have not been independently checked.
What Anthropic has said
Users had flagged the behavior before. A bug report filed in Anthropic's public Claude Code repository on Aug. 11, 2025, said approved commands containing credentials were being stored with the credentials in plain text. An automated bot closed it on Jan. 3 after 60 days without activity. Apiiro cited four related reports. Each was closed by the same bot, and none got a reply from Anthropic, the researchers said. The most recent was closed on Nov. 5, the day the research was published.
Anthropic has not issued a formal statement. On Saturday, Boris Cherny, who leads Claude Code, responded on the Hacker News discussion board. "Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this," he wrote.
Cherny said the file "is meant to stay local" and that because Claude Code ignores it automatically when it creates the file, "in this case the files were manually created and checked in." Apiiro's count of Claude co-authored commits points to another route. So does a recent Claude Code changelog entry, which fixed self-hosted runner sessions that were committing a leftover copy of the file.
Cherny urged users to switch to the tool's auto mode and to turn on the secret scanning that GitHub and other code hosts offer. He listed possible fixes, including "building in basic secret scanning," and said the team would prototype them "before we ship something." When a commenter noted that auto mode can still save such rules, he replied, "Yeah good catch." Sayer found no change addressing secrets in saved rules in the Claude Code changelog through version 2.1.322.
The exposure comes as Anthropic prepares to go public. The company filed for an initial public offering with the Securities and Exchange Commission on Oct. 26 and amended the filing on Nov. 2.
What developers should do
Apiiro's advice is to rotate first and clean up second. Change every password, token and key the file has ever held, because removing the file does not erase it from git history, forks or clones. Search repositories for .claude/settings.local.json and the shared .claude/settings.json, including their history.
If the file is tracked, stop tracking it with git rm --cached and add it to the repository's own .gitignore. Open the file on your machine even if it was never committed, and delete any rule that contains a secret. Going forward, Apiiro recommends keeping secrets out of commands by referring to them as environment variables, so a saved rule records a name like $DB_URL rather than the password, and approving broad patterns instead of single commands.