Thousands of sensitive secrets, including database passwords and API tokens, have been found amid Claude Code settings files in public GitHub repositories, with the leak stemming from a partial oversight in how the tool handles approval for automated shell commands, according to AI security researchers at Apiiro.
Claude Code handles automated shell commands on a developer's machine. To avoid repeated prompts, the tool stores a user's approval for a command in a local settings file.
When a user selects the 'Yes, and don't ask again' option for a shell command, that choice is saved in the .claude/settings.local.json file. The command itself is often written as is into that file, including any sensitive information that may be embedded in it. Apiiro researchers discovered thousands of such secrets across GitHub repositories.
Anthropic's documentation notes that this file is added to the developer's global .gitignore list, which usually prevents it from being shared publicly.
The issue is not really a significant security issue if the settings file stays on the user's local machine, assuming that machine is not compromised.
Analysis
Why This Matters
- Developers using Claude Code risk exposing sensitive credentials if they commit the settings file to public repositories.
- The leak could allow attackers to access databases, cloud services, and other infrastructure.
- Highlights the need for AI coding tools to handle secrets more securely.
Background
Claude Code is an AI coding assistant from Anthropic that can execute shell commands. To streamline repetitive approvals, it stores user permissions locally. The flaw arises because those saved commands can contain sensitive data that is not automatically sanitized.
What to Watch
- Whether Anthropic updates Claude Code to sanitize secrets from stored commands.
- Whether developers scan their repositories for exposed settings files.
- Potential for further scrutiny of how AI coding tools handle sensitive data.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedThe option is labelled “Yes, and don't ask again.”Ars Technica - All content: “When a user chooses the "Yes, and don't ask again" option to approve running a command”
- SupportedClaude Code is leaking secrets on GitHub, researchers find.Ars Technica - All content: “Claude Code is accidentally exposing secrets all over GitHub.”
- SupportedClaude Code settings files can expose passwords and API tokens when committed to repositories.Ars Technica - All content: “they discovered thousands of secrets , including database passwords, API tokens, and root logins, amid Claude Code settings files embedded in GitHub repositories.”
- SupportedThousands of sensitive secrets, including database passwords and API tokens, were found amid Claude Code settings files in public GitHub repositories.Ars Technica - All content: “they discovered thousands of secrets , including database passwords, API tokens, and root logins, amid Claude Code settings files embedded in GitHub repositories.”
- SupportedThe finding was made by AI security researchers at Apiiro.Ars Technica - All content: “That's the finding of AI security researchers at Apiiro”
- SupportedThe leak stems from a partial oversight in how Claude Code handles approval for automated shell commands.Ars Technica - All content: “The leak stems from the way Claude Code handles user approval for automated shell commands.”
- Partly supportedClaude Code handles automated shell commands on a developer's machine.Ars Technica - All content: “The leak stems from the way Claude Code handles user approval for automated shell commands. When a user chooses the "Yes, and don't ask again" option to approve running a command, that choice gets stored as part of a rule in the local ".claude/settings.local.json" file on the user's computer.”
- SupportedThe tool stores a user's approval for a command in a local settings file to avoid repeated prompts.Ars Technica - All content: “When a user chooses the "Yes, and don't ask again" option to approve running a command, that choice gets stored as part of a rule in the local ".claude/settings.local.json" file on the user's computer.”
- SupportedChoosing “Yes, and don't ask again” saves the approval in .claude/settings.local.json.Ars Technica - All content: “When a user chooses the "Yes, and don't ask again" option to approve running a command, that choice gets stored as part of a rule in the local ".claude/settings.local.json" file on the user's computer.”
- SupportedThe command itself is often written as-is into that settings file, including sensitive information it may contain.Ars Technica - All content: “the command itself is often written to that settings file as is, including any sensitive information that may be embedded within it.”
- SupportedAnthropic's documentation says the settings file is added to the developer's global .gitignore list, which usually prevents it from being shared publicly.Ars Technica - All content: “Anthropic notes in its Claude Code documentation that this particular settings file gets added to the developer's global .gitignore list , which usually prevents it from being shared publicly.”
- SupportedThe issue is not really a significant security issue if the settings file stays on the user's local machine and that machine is not compromised.Ars Technica - All content: “This isn't really a significant security issue if the settings file stays on the user's local machine (assuming that machine doesn't become compromised itself, of course).”
