Claude Code saves passwords to a file that ends up on GitHub: thousands of secrets exposed
Apiiro found 2,539 secrets in public repos tied to Claude Code’s “don’t ask again” option. What happened, what Anthropic says and how to protect yourself.
In 30 seconds
- When you approve a command with “Yes, and don’t ask again,” Claude Code saves the full command, credentials included, to
.claude/settings.local.json. - Apiiro found 1,122 public copies of that file holding at least one secret; counting history and other files, 2,539 secrets across 1,994 repositories.
- This is exposure risk, not a proven breach: Apiiro didn’t test whether keys still worked, though one company confirmed its key was live.
Coding agents that run in the terminal ask for permission before executing commands. To avoid asking twice, Anthropic’s Claude Code offers a standing approval. The problem, according to research by security firm Apiiro published in early November, is where and how that approval is stored.
What they found
When a developer picks “Yes, and don’t ask again” for a shell command, Claude Code writes an allow rule to the project’s .claude/settings.local.json file. That rule keeps the full text of the command. If the command contained a password, a token or a connection string, it sits there in plain text. And if the file is pushed to a public repository, anyone can read it.
Researchers Shmulik Cohen and Matan Giladi searched GitHub between November 1 and 3, according to iTWire.
The numbers measure different things. The 1,122 copies are local files that, in their current version, contain at least one secret. The 2,539 total also adds secrets that survive only in git history, in the shared .claude/settings.json file and in agent transcripts. Among the findings, according to the Cloud Security Alliance (CSA) summary, were 379 database passwords, 43 SSH logins to public servers and 23 AWS keys.
Apiiro notified the affected organizations, and one confirmed its key still worked. The status of the rest is unknown. The researchers also found that in 539 of 1,105 traced repositories, a commit co-authored by Claude changed the file — which, as iTWire stresses, doesn’t prove the agent introduced every credential.
Another uncomfortable finding: according to the CSA, the popular scanners gitleaks and TruffleHog missed 215 of the files, mostly because the passwords were embedded in command syntax such as PGPASSWORD= or mysql -p.
Why Claude Code and not others
Apiiro compared the documentation of 16 coding agents and, according to the CSA, Claude Code was the only one confirmed to save the full approved command to a project file by default. GitHub isn’t the only place it shows up: in April, Check Point had already found the same file, with credentials, inside packages published to npm.
Nor is this news to Anthropic. A report on the Claude Code repository described the behavior in August 2025 and was closed automatically in January 2026 with no maintainer response, according to the CSA and iTWire.
- Aug 11, 2025First public report
A user flags the issue on GitHub.
- Jan 3, 2026Closed automatically
The report is closed as “not planned.”
- Apr 2026Check Point and npm
Credentials in packages that shipped the file.
- Nov 1–3Apiiro’s scan
Affected companies are notified.
- Nov 5–6Research published
Picked up by the press and the CSA.
What Anthropic says
We found no public response from Anthropic to the research. Its documentation does describe a safeguard: the first time Claude Code writes that file inside a git repository, it adds an exclusion to the developer’s global git excludes file. The catch, iTWire and the CSA note, is that the rule lives only on the machine that created it: it doesn’t travel with the project, doesn’t protect teammates or CI runners, and doesn’t help if the file was already tracked.
Environment variables aren’t enough
Putting PGPASSWORD=... in front of the command doesn’t fix anything: the assignment is part of the approved text and gets saved all the same. The safer approach is to reference the credential from a secrets manager or a variable that’s already set, without typing the literal value.
