Claude Code Approval Files Have Leaked Thousands of Passwords and Keys Onto Public GitHub

The leak comes from the way Claude Code remembers which shell commands a user has approved. When a developer picks "Yes, and don't ask again", the tool saves the approved command as a permission rule in a project file called .claude/settings.local.json. Sometimes that rule is stored as a general pattern, but often the full command is written out as typed, including any password or token in it. If that file is committed to a public repository, the credential is public too.

The finding matters for any company whose engineers use AI coding agents. Credentials that grant direct access to production databases and servers are piling up in a file that many teams do not think of as sensitive, and that standard secret scanners often fail to flag.

The Scale of the Exposure

Apiiro examined 104,185 copies of the local settings file across 103,617 public repositories, according to The Hacker News's account of the research. About 1.1%, or 1,122 copies, held at least one secret, adding up to 1,379 distinct secrets. More than a third of these gave direct access to a database, including 379 database passwords. The researchers also counted 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys.

The researchers linked the exposed files to 63 organisations, mostly software companies. The most serious cases they described were an admin-level cloud key belonging to a database vendor and the owner password for a medical-records database.

Deleting the file does not undo the leak. Apiiro found 734 more secrets in older versions of the file across 509 repositories, often where it had later been removed, and 211 forks of 74 repositories carried the same credentials. The team-shared .claude/settings.json file had secrets in 298 of 76,011 copies. Counting git history, forks and saved agent chat logs, the total came to 2,539 secrets across 1,994 repositories.

Apiiro did not test whether the secrets still worked, though one company it notified confirmed its key was live. The researchers did not say whether anyone had used the exposed credentials.

Why the Files End Up Public

Anthropic's Claude Code documentation says the local settings file is added to the developer's global git exclusion list, which normally keeps it out of commits. Ars Technica noted that the file poses little risk if it stays on the user's machine. But that protection lives on the individual computer, not in the project's own .gitignore, so it does not travel with the repository. In 539 of 1,105 repositories where Apiiro traced how the file got in, it was changed in a commit that listed Claude as a co-author, which suggests the agent often commits the file itself.

Of 16 coding agents whose documentation the researchers reviewed, Claude Code was the only one confirmed to save the full approved command in a project file by default. The problem had been raised before: a bug report filed on August 11, 2025 described the same behaviour and was closed by an automated bot as "not planned" after 60 days without activity. The Hacker News reported that related reports cited by the researchers were also closed by a bot without a reply from Anthropic, and that it had no response from the company.

Common scanning tools caught only part of the problem. Run over every affected file, gitleaks flagged 564 of the 1,122 and TruffleHog flagged 643, while 215 were missed by both. Most of the misses were passwords typed directly into commands, which look like ordinary text to tools that hunt for known key formats.

Apiiro advised teams to rotate every credential the files have ever held before cleaning anything up, then stop tracking the local settings file with git rm --cached and add it to each repository's .gitignore. It also recommended keeping secrets in environment variables pulled from a secrets manager, approving command patterns rather than single commands, and treating agent folders such as .claude, .cursor and .gemini like .env files, with secret scanning in pre-commit checks and CI pipelines, including git history.