Claude Code Settings Leak Put Real Secrets in 1,122 Public Repos

What happened

The problem starts with a single click. When a user asks Claude Code to check a database or call an API, the tool proposes a command and asks for confirmation before running it; choosing "Yes, and don't ask again" saves that exact command, password included, as a permanent allow rule in .claude/settings.local.json inside the project folder. The file is meant to stay on the developer's machine, and Claude Code adds it to the user's global git ignore list the first time it creates the file in a repo — but once the file is already under version control, the ignore rule no longer helps, and the file is published with the rest of the code.

Apiiro counted the scale with GitHub code search between Nov 1 and 3, 2026: public repos held 104,185 copies of the file across 103,617 repositories, and 1,122 of them (1.1%) contained a real secret, adding up to 1,379 distinct secrets. Counting older versions, the shared settings.json teams commit on purpose and saved agent chat logs, the total reaches 2,539 distinct secrets across 1,994 repositories. By category: 379 database passwords, 149 AI model API keys, 122 Supabase service-role keys, 110 Google API keys and 23 AWS keys.

The exposed credentials include a database vendor's own admin-level cloud key, a production Azure Postgres password, a Square production token and the owner password for a medical-records app's database. Sixty-three organizations are affected, mostly software companies of all sizes, and one confirmed to Apiiro that its leaked key had been live. Scanners did not catch everything either: gitleaks flagged 564 of the 1,122 files and TruffleHog 643, while 215 were flagged by neither. Users have reported this mechanism in Claude Code's repo since August 2025; Apiiro cites four such reports and says none got a reply from Anthropic, and as of Nov 8 Anthropic has not publicly responded and the documentation has not changed.

Key facts

1. Research by: security firm Apiiro, published Nov 5, 2026, by Shmulik Cohen and Matan Giladi
2. Mechanism: choosing "don't ask again" saves the command, password included, in plain text to .claude/settings.local.json in the project folder
3. Counting window: Nov 1 to 3, 2026, using GitHub code search
4. Scale: 104,185 public copies across 103,617 repositories; 1,122 hold a real secret, 1.1%
5. Secret counts: 1,379 distinct secrets in the 1,122 files; 2,539 in total counting history and shared files, across 1,994 repositories
6. Categories: 379 database passwords, 149 AI model API keys, 122 Supabase service-role keys, 110 Google API keys, 23 AWS keys
7. Organizations affected: 63, mostly software companies; one confirmed its leaked key had been live
8. Notable exposures: a database vendor's admin-level cloud key, a production Azure Postgres password, a Square production token, a medical-records app database owner password
9. Scanner gaps: gitleaks flagged 564 and TruffleHog 643 of the 1,122 files, while 215 were flagged by neither, about one in five; in 539 of the 1,105 repositories Apiiro traced, a commit co-authored by Claude had changed the file
10. History and response: users have reported this mechanism since August 2025, with four reports unanswered; as of Nov 8 Anthropic has not publicly responded; Apiiro tested no credentials, so whether they still work is unknown