// ARS TECHNICA — INTELLIGENZA ARTIFICIALE
Claude Code is accidentally exposing secrets all over GitHub
“Do not ask again” prompt leads to passwords, API keys, and more being shared.
Claude Code is leaking sensitive information on public GitHub instances thanks to a partial oversight in the way its settings files are handled. That’s the finding of AI security researchers at Apiiro, who discovered thousands of secrets, including database passwords, API tokens, and root logins, amid Claude Code settings files embedded in GitHub repositories.
The leak stems from the way Claude Code handles user approval for automated shell commands. When a user chooses the “Yes, and don’t ask again” option to approve running a command, that choice gets stored as part of a rule in the local “.claude/settings.local.json” file on the user’s computer. That rule is sometimes coded as a pattern, but the command itself is often written to that settings file as is, including any sensitive information that may be embedded within it.
This isn’t really a significant security issue if the settings file stays on the user’s local machine (assuming that machine doesn’t become compromised itself, of course). And Anthropic notes in its Claude Code documentation that this particular settings file gets added to the developer’s global .gitignore list, which usually prevents it from being shared publicly.
But that .gitignore setting isn’t reflected at the repo level, meaning the sensitive file can be uploaded accidentally if a repo is cloned to another machine or a folder becomes a repo later, for instance. In many cases, Claude Code itself will commit changes to the settings file without the user’s input, Apiiro writes.
Apiiro’s researchers found over 100,000 cases where Claude Code’s local settings file had been uploaded to a public GitHub repository. Of these, only about 1,100 from 63 different organizations contained secrets such as public API tokens, database passwords, or private keys. Even after these files are discovered and removed from a repository, the secrets can persist in forks of the original project if a GitHub user isn’t careful.
Although this security issue is getting more attention now, it was flagged in a Claude Code bug report as far back as August 2025. Other bug reports also noted that the sensitive settings file was sometimes not added to the user’s .gitignore list or that Claude Code could add the sensitive commands to another file that was not protected from git sharing. These bug reports were all closed without action after 60 days of inactivity.
In a comment thread on Hacker News over the weekend, Claude Code’s Boris Cherny said the team is “looking into what we can do to prevent this.” That said, he noted that these settings files should pretty much never be checked in to a user’s git source control and that cases like these seemed to come up only when “the files were manually created and checked in.”
In the meantime, Cherny recommended using Claude Code’s auto mode, which uses classifiers to automatically route “routine permission prompts” without requiring what Cherny calls “manually maintaining finicky allow/deny lists.” But when another user noted that sensitive commands can still be saved to settings files in auto mode, Cherny said that was a “good catch” and added that the team is “thinking through what we can do to improve this.”
Cherny also recommends Claude Code users make use of secret scanners—which can trawl files for sensitive information and scrub it out—and said that the team was considering building this kind of secret scanning into Claude Code itself in the future. That said, the Apiiro researchers found that 215 of the roughly 1,100 public secrets it found in Claude Code settings files were not flagged by two popular secret scanners, gitleaks and TruffleHog.