Apiiro, a software security firm, disclosed this week that Anthropic's Claude Code can write plaintext credentials into a project file whenever a developer approves a shell command with the Yes, and don't ask again option. Instead of storing just the permission, the agent saves the entire command verbatim, password or API key included, as an allow rule inside .claude/settings.local.json. Claude Code adds that path to the developer's global git excludes rather than the repository's own .gitignore, so a fresh clone or a second machine can commit it like any other file.
Scaling up the search shows how far the pattern spread. Apiiro scanned 104,185 public copies of .claude/settings.local.json across 103,617 GitHub repositories and found 1,122 files holding at least one secret. Expanding into git history, forks and agent transcripts pushed the total to 2,539 distinct secrets across 1,994 repositories, including 379 database passwords, 122 Supabase service-role keys, 43 SSH logins and 23 AWS access keys. Two hundred and fifteen of them slipped past both TruffleHog and GitHub's own secret scanning. In 539 of the 1,105 repositories the researchers traced, a commit co-authored by Claude itself changed the file. Sixty-three organisations were affected.
Anthropic's Claude Code team responded that settings.local.json is meant to stay local and that the tool gitignores it automatically when Claude creates it, so the exposed copies were hand-made and checked in. It also pointed developers to auto mode and to enabling secret scanning on any repository. The immediate fix is rotation, not deletion: change every credential the file has ever held, run git rm --cached .claude/settings.local.json, then add the path to .gitignore. Removing the file leaves older versions readable in git history and in every fork.