Security researchers at Apiiro revealed that Anthropic’s Claude Code agent has inadvertently leaked thousands of sensitive credentials across public GitHub repositories. When users select the “Yes, and don’t ask again” option for shell command permissions, Claude Code records the exact command string into a local configuration file (.claude/settings.local.json). If a developer types a command containing hardcoded passwords, API tokens, or SSH keys, that raw text is stored in plain text. While Claude Code attempts to prevent exposure by adding the configuration file to the user’s global git excludes on their local machine, it fails to add it to the project’s native .gitignore. Consequently, when developers initialize new repositories or clone projects—and in hundreds of cases, when Claude itself commits changes—the files are pushed directly to public repositories. nvestigations uncovered over 104,000 copies of the settings file on public GitHub, with thousands containing valid database passwords, cloud service keys, and private tokens. Furthermore, popular secret scanners like Gitleaks and TruffleHog frequently missed these embedded passwords because they appeared as regular command-line strings rather than standard token formats.

Full report : Flaw in local configuration management causes autonomous coding tool to save literal shell commands including database passwords and API keys into tracked project settings.