Developers’ passwords and API keys have appeared in public GitHub repositories after Claude Code saved approved commands containing them, The Hacker News reported, citing findings disclosed by Apiiro. The security company found secrets in 1,122 public copies of .claude/settings.local.json; it recommends rotating exposed credentials before removing the files, because copies can survive in repository history and forks.
The findings concern developers and organizations using Anthropic’s coding assistant, particularly those approving commands that contain database passwords, access tokens or cloud keys. Apiiro did not test whether the credentials still worked, although one company notified earlier that week confirmed its key had been live. Whether anyone has used the exposed secrets remains unknown.
How an approval becomes a stored secret
Claude Code normally asks permission before running most shell commands. As The Hacker News describes its permissions documentation, selecting “Yes, and don’t ask again” saves an allow rule in the project’s .claude/settings.local.json file. Matching commands can then run without another prompt in later sessions.
The saved permission may cover a command pattern, such as npm test *, or one exact command. When it stores the exact command, passwords and tokens written into that command remain in plain text. Apiiro found such rules in public repositories and reproduced the behavior with models Opus 5.5 and Fable 5.1.
Claude Code has a safeguard against committing the file. Its settings documentation says that when it first writes the file inside a Git repository, it adds the path to the user’s global Git exclusions. That tells Git on that computer to ignore the file across repositories.
But the exclusion belongs to one user’s configuration on one computer. It does not travel with the project, and the researchers said it does not protect a file already committed. Claude Code does not add the path to the project’s own .gitignore, which supplies shared rules for excluding files.
In 539 of the 1,105 repositories Apiiro traced, a commit naming Claude as a co-author changed the settings file. The researchers interpreted that as evidence that Claude often commits the file itself.
What was exposed
Apiiro searched 104,185 public copies of .claude/settings.local.json across 103,617 GitHub repositories. Of those files, 1,122—about 1.1%—contained at least one secret, for a total of 1,379 different secrets.
The researchers counted a value when it matched a known key format or appeared as a password or token beside a public server address. An AI reviewer also had to agree with the classification.
More than a third of the secrets provided direct database access, including 379 database passwords. Other findings included 43 SSH logins for remote access to public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys.
The file owners included 63 organizations, mostly software companies of varying sizes. Apiiro highlighted a database vendor’s own administrator-level cloud key and the owner password for a medical-records database among its strongest findings.
As of Monday, every file containing a secret remained on its repository’s default branch—the main development branch shown by default. In half of those repositories, the file had been present for at least 217 days.
Removing the current file leaves other exposure paths. Earlier versions contained another 734 secrets across 509 repositories that were absent from every current copy, usually because the file had been deleted. Another 211 forks—separate repository copies—of 74 repositories carried the same secrets as their originals.
Apiiro also found secrets in 298 of 76,011 copies of .claude/settings.json, a shared settings file that teams intentionally commit, mostly within allow rules. Including shared settings, historical versions and saved agent chat logs, the researchers counted 2,539 secrets across 1,994 repositories.
Among 16 coding agents whose documentation Apiiro compared, Claude Code was the only one confirmed to save the full approved command in a project file by default.
Scanners missed command-line passwords
Apiiro ran the Gitleaks and TruffleHog secret scanners against every copy, without the tools’ verification step. Among the 1,122 local settings files containing secrets, Gitleaks flagged 564 and TruffleHog flagged 643. Neither tool flagged 215 files.
Most missed values were passwords embedded in commands. A scanner looking for a recognizable key format can overlook an ordinary-looking word after PGPASSWORD=, sshpass -p or mysql -p.
Exposure can also happen without a GitHub commit. The plain JSON file sits inside the project folder and can be included in an npm package, Docker image, ZIP archive or synchronized folder. The report cited the September 2025 Shai-Hulud worm as an example of malware searching developer machines with TruffleHog, which flagged more than half of these files in Apiiro’s scan.
Users had previously reported the storage behavior. An August 11, 2025 bug report described approved commands containing API keys and tokens being saved word for word; an automated bot closed it as “not planned” on January 3 after 60 days without activity. Apiiro said all four related reports it cited had been closed by that bot without a reply from Anthropic; the latest closure was the day before the report.
Rotate credentials before cleaning up
Apiiro recommends that developers search their GitHub organizations for both settings filenames and inspect Git history, including repositories where the files have disappeared. Every password, token and key those files have held should be rotated before cleanup.
Developers should then stop tracking the local settings file with git rm --cached .claude/settings.local.json and add its path to the repository’s .gitignore. They should also inspect local copies, even those never committed, and remove rules containing secrets.
To avoid saving credentials in future approvals, Apiiro recommends referring to secrets through variables supplied by a secrets manager, such as $DB_URL, so the rule stores the variable name. It also recommends approving command patterns such as Bash(npm run:*) instead of individual commands containing sensitive values.
Security teams should treat agent directories—including .claude/, .cursor/, .gemini/ and .specstory/—and agent memory files as potential secret stores, like .env configuration files, on laptops and in repositories. Apiiro recommends adding them and their Git history to pre-commit and continuous integration scanning, ensuring scanners detect passwords inside commands, and including .claude/settings.local.json in organizational .gitignore templates. Prioritize credentials paired with public server addresses, the researchers advise, because those provide an immediate route to access.
