Claude Code Leaks Secrets on GitHub Due to Settings File Handling Oversight

Claude Code Settings Files Exposed

AI security researchers at Apiiro identified a vulnerability in Claude Code that results in sensitive information being exposed on public GitHub instances. The issue involves the accidental upload of Claude Code's local settings files, which can contain critical data such as database passwords, API tokens, and root login credentials.

Mechanism of the Leak

The problem originates from how Claude Code handles user approval for automated shell commands. When a user selects "Yes, and don’t ask again" to approve a command, this decision, along with the command itself (potentially containing sensitive data), is stored in the local ".claude/settings.local.json" file. While Anthropic's documentation states this file is added to a global .gitignore list, this exclusion does not always apply at the repository level.

This discrepancy means that if a repository is cloned or a folder later becomes a repository, the sensitive settings file can be inadvertently committed and uploaded to public GitHub. Claude Code itself can also commit changes to this settings file without explicit user input, increasing the risk of exposure.

Scope of the Exposure

Apiiro's research uncovered over 100,000 instances where Claude Code's local settings file had been uploaded to public GitHub repositories. Among these, approximately 1,100 files from 63 different organizations were found to contain actual secrets, including public API tokens, database passwords, or private keys. Even after removal from a repository, these secrets can persist in forks of the original project if not properly addressed.