Apiiro found about 1,100 public Claude Code settings files holding real secrets. Check your repos for settings.local.json

One convenience click in a coding agent has been writing passwords into a file that ends up on GitHub.

What happened

Security researchers at Apiiro found over 100,000 cases where Claude Code's local settings file had been uploaded to a public GitHub repository, Ars Technica reports. About 1,100 of them, from 63 organizations, held secrets such as API tokens, database passwords and private keys.

The cause is the "Yes, and don't ask again" option. Claude Code's documentation confirms that choosing it saves the approval as an allow rule in .claude/settings.local.json. According to Ars, the command is often written as is, including any secret typed into it. The docs say Claude Code adds that file to your global git excludes the first time it writes it, but a file created by hand must be added to .gitignore manually. Ars notes the exclusion is not set at the repo level, so the file can slip in when a repo is cloned elsewhere or a folder becomes a repo later.

Claude Code's Boris Cherny said on Hacker News the team is looking into prevention, and recommended secret scanners. Apiiro found that 215 of the roughly 1,100 secrets were not flagged by gitleaks or TruffleHog. Removing the file does not remove secrets from forks.

My take

This is not only a developer problem. Anyone building automations with a coding agent is pasting API keys for CRMs, payment tools and databases into terminal commands all day.

What I would do this week:

• Search every repo you or your clients own for settings.local.json and check its history, not just the current version.
• Rotate any key that ever appeared in one. Assume forks exist.
• Add the file to each repo's .gitignore, not only your global excludes.
• Stop typing secrets inline. Load them from environment variables or a secrets manager so approved commands never contain them.

The bigger lesson: every agent convenience feature writes state somewhere. Find out where before a client's database password does.