Claude Code settings files leak thousands of secrets on GitHub
Security researchers discovered over 100,000 public Claude Code settings files on GitHub.
Source: Ars TechnicaClaude Code, Anthropic’s AI‑powered coding assistant, is unintentionally publishing sensitive credentials across public GitHub repositories, a problem flagged by security firm Apiiro. The exposure stems from the way the tool stores user‑approved shell commands in a local settings file that can be committed to version control, putting passwords, API keys and other secrets at risk.
How did Claude Code expose secrets on GitHub?
When a user selects the “Yes, and don’t ask again” option for an automated shell command, Claude Code writes that approval into a local file called .claude/settings.local.json. The file records the command verbatim, which often contains embedded credentials. According to Ars Technica, Claude Code sometimes adds or updates this file without explicit user action, and the file is not automatically added to the repository‑level .gitignore list. As a result, developers who later initialize a Git repository in the same directory – or who clone a repository that already contains the file – can inadvertently push the settings file to a public repo.
What kinds of secrets were found and how many instances were identified?
Apiiro’s analysis uncovered over 100,000 public instances of the Claude Code settings file on GitHub. Of those, about 1,100 files from 63 organizations contained actual secrets, including:
- Public API tokens
- Database passwords
- Private SSH keys and root logins
- Other credential strings embedded in shell commands
Even after the offending files are removed, the leaked data can persist in forks or cached snapshots, extending the window of exposure.
Why didn’t the default .gitignore protect these files?
Anthropic’s documentation states that the settings file should be added to a global .gitignore on the developer’s machine, which prevents accidental commits from that workstation. However, the global ignore does not propagate to the repository itself. If a developer later creates a repo in the same folder, or if the folder is turned into a repo after the file exists, Git will track the file unless a repository‑level .gitignore explicitly excludes it. Apiiro observed that Claude Code sometimes commits changes to the settings file automatically, bypassing the developer’s chance to review the diff.
What is Anthropic’s response and what mitigations are being recommended?
Claude Code’s lead, Boris Cherny, acknowledged the issue on a Hacker News thread, saying the team is “looking into what we can do to prevent this.” He urged users to avoid checking the settings file into source control and to employ secret‑scanning tools. Cherny also highlighted the tool’s auto mode, which uses classifiers to auto‑approve routine permission prompts, but admitted that even in auto mode the command may still be written to the settings file. The company is considering built‑in secret scanning for future releases.
How can developers protect themselves right now?
- Manually add the file to the repo’s
.gitignore– ensure that.claude/settings.local.jsonis listed in every project’s ignore list. - Run secret‑scanning utilities such as gitleaks or TruffleHog on all commits before pushing. Apiiro noted that 215 of the 1,100 leaked secrets were missed by both tools, underscoring the need for multiple scanners.
- Avoid “don’t ask again” approvals for commands that embed credentials. Use temporary environment variables or secret‑management services instead.
- Audit commit history regularly for accidental inclusion of the settings file, especially after initializing a new repo.
What does this incident say about AI‑assisted coding tools?
Claude Code’s leak illustrates a broader risk: AI agents that generate or execute code can embed sensitive data in artifacts that developers may treat as mundane configuration files. When those artifacts are automatically versioned, the line between convenience and security blurs. The incident joins other recent examples—such as Meta’s Muse agent sharing guessable URLs—to remind the community that AI tooling must be designed with secure defaults, especially around credential handling.
How to investigate and remediate with Graf by
Graf by offers a few practical ways to audit and clean up exposed secrets:
- Graf by Code (/code) lets you clone a repository, run custom scripts and install secret‑scanning tools like gitleaks directly in the browser‑based IDE. You can script a scan that flags any occurrence of
.claude/settings.local.jsonand automatically removes or redacts the credentials. - Graf by Chat (/chat) provides a multi‑model environment where you can ask an assistant to explain the output of a secret‑scanner, suggest remediation steps, or generate a repository‑level
.gitignoresnippet that covers Claude Code files.
Both apps operate on the same cloud model pool used by Claude Code, so you can experiment with alternative prompts or safety‑focused configurations without leaving the Graf by workspace.
Source: https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/
To explore this yourself, open Grafy Code: an AI coding studio.
Frequently asked questions
Did Claude Code itself upload the settings files, or were they added manually?
Apiiro observed that Claude Code can auto‑commit changes to the local settings file, meaning the tool sometimes pushes the file without explicit user action. However, many of the leaked files were also manually added when developers created a Git repo in a folder that already contained the settings file.
Are the built‑in secret scanners in Claude Code sufficient to catch all leaks?
No. In the Apiiro study, 215 of the 1,100 leaked secrets were not detected by either gitleaks or TruffleHog, the two popular scanners used. This suggests that relying solely on Claude Code’s future built‑in scanner would not guarantee complete coverage.
What immediate steps should a team take if they discover a leaked Claude Code settings file?
First, remove the file from the repository and any forks. Then, rotate all exposed credentials (passwords, API keys, SSH keys). Add .claude/settings.local.json to the project’s .gitignore, run multiple secret‑scanners on the full history, and consider using Graf by Code to automate the cleanup and verification process.
Source: Ars Technica — Claude Code is accidentally exposing secrets all over GitHub
More news
Anthropic AI models accelerating their own development
A new METR report reveals Anthropic's models are improving twice as fast as last year, driven largely by AI-assisted research and development.
Anthropic explores how AI agents use memory to improve performance
Anthropic researchers have identified key components of agent memory, including a 'dreaming' process that helps models correct errors and refine knowledge.
Anthropic IPO Valuation Talks Drop to $1.3 Trillion
Anthropic's IPO valuation talks fell to $1.2–$1.3 trillion after investors rejected $1.5 trillion, amid a Nasdaq rout and questions over its S-1 filing.