Security firm Apiiro scanned 104,185 public copies of .claude/settings.local.json on GitHub and found 2,539 credentials in the open across 1,994 repositories — production database passwords, Square tokens, Azure PostgreSQL credentials, and at least one medical-records admin password confirmed still active. The source of every single leak is a button almost every Claude Code user has clicked: “Yes, and don’t ask again.”
The Feature That Betrayed You
When Claude Code asks permission to run a Bash command and you pick “Yes, and don’t ask again,” it saves the exact command string — word for word — as an allow rule in .claude/settings.local.json. That is the feature working correctly. The problem is what developers put inside those commands.
Inline credentials are common in one-off scripts: an environment variable set before a database call, a -p password flag, a Bearer token in a curl header. Claude Code saves all of it. The file then sits in the project directory, and if the developer runs git add . without thinking, the secret commits.
Claude Code is supposed to gitignore this file — but only when it creates it in a fresh repository. Forks, clones, and repos where the file appears outside that specific scenario get no automatic protection. Of the 16 AI coding agents Apiiro reviewed, Claude Code was the only one that saves the full approved command in a project-level file by default.
The Numbers Are Worse Than the Headline
Apiiro’s initial scan of live files found 1,122 files containing at least one secret — roughly 1.1% of everything they looked at. Then they checked git history.
When git history, shared settings files, and agent transcript files were included, the total jumped to 2,539 distinct secrets across 1,994 repositories and 63 organizations. The detail that should concern every security team: 215 of those secrets evaded both Trufflehog and GitHub Secret Scanning. Standard tooling was not enough.
The 215 that slipped through are likely non-standard formats — custom API keys, internal service tokens, database passwords — that don’t match the entropy heuristics or known-pattern rules these scanners use. Your CI pipeline said clean. It was not.
Fix This Now: Four Steps
Rotate before you clean up. If your credentials were in a public file at any point, treat them as compromised regardless of whether anything looks suspicious.
# Check whether the file exists in your git history
git log --all --full-history -- .claude/settings.local.json
# If it appears, inspect what was in it
git show <commit-hash>:.claude/settings.local.json
# Untrack the file without deleting it locally
git rm --cached .claude/settings.local.json
# Add to gitignore
echo ".claude/settings.local.json" >> .gitignore
git add .gitignore
git commit -m "security: exclude claude local settings from version control"Anthropic has shipped a fix in Claude Code 2.0.54 that adds the file to gitignore going forward. Update now — but the patch does nothing for credentials already in your repository history. Rewriting git history to strip secrets requires git filter-branch or BFG Repo Cleaner and a force push; at that point, the simpler answer is usually just to rotate.
Not a Bug: A Design Choice With Consequences
This is worth stating plainly: the “don’t ask again” feature did exactly what it was designed to do. It saved the command. The command had a secret in it. The file wasn’t gitignored everywhere it needed to be. No CVE is attached to this because there is no exploit chain, no attacker-controlled input, no memory corruption. It is a convenience feature that scales badly when developers treat shell commands as scratch space for credentials.
Claude Code has accumulated 28 CVEs in its first year — two at CVSS 10.0. The settings file exposure sits in a different and arguably more dangerous category: behavior that is correct by design but misaligned with how real development works at scale. It won’t get a patch severity label. It won’t trigger your vulnerability scanner. It will quietly sit in your git history until someone reads it.
The lesson extends past Claude Code. Any AI coding tool that creates local config files inside repository directories — cursor rules, Continue configuration, agent transcript files — deserves the same scrutiny. Review what Claude Code’s settings files actually contain before your next push.
