Anthropic’s Claude Code is quietly leaking credentials into public repositories due to a permissions bug that saves approved commands with embedded secrets as plain text. Security firm Apiiro scanned 104,185 instances of the .claude/settings.local.json file across 103,617 public GitHub repositories and discovered 1,122 files containing at least one secret. In total, 1,379 distinct secrets were exposed, ranging from database passwords to AWS keys, creating a significant attack surface for organizations relying on AI coding agents.

The 'Don't Ask Again' Trap

The vulnerability stems from the "Yes, and don't ask again" option in Claude Code's permission system. When a user approves a command containing credentials, such as PGPASSWORD=secret psql, the system stores the full command string in .claude/settings.local.json. Unlike ephemeral session data, this file persists in the repository's root. A bug report from August 2025 noted that commands with credentials are "stored as is with plain text credentials," a behavior confirmed by Apiiro researchers using Opus 5.5 and Fable 5.1 models. Of 16 coding agents compared, Claude Code was the only one confirmed to save the full approved command in a project file by default.

Scanners Missed 215 Secrets

Standard secret detection tools failed to catch a significant portion of these leaks. While Gitleaks flagged 564 secrets and TruffleHog flagged 643, both scanners missed the same 215 secrets entirely. The majority of these misses were passwords embedded directly within command syntax, such as after sshpass -p or mysql -p, which lack the provider-specific prefixes that pattern-matching algorithms rely on. The report indicates that neither scanner was configured with its verification step enabled during the scan, further reducing efficacy against non-standard formats.

Git History and Forks Compound the Risk

The exposure extends beyond current file states. Apiiro found that in 539 of the 1,105 traced repositories, a commit authored by Claude itself modified the settings file, suggesting the agent often commits its own configuration. Although Claude Code attempts to add the file to the global git excludes, this rule does not travel to CI runners or teammate clones. Consequently, 734 additional secrets were found in git history across 509 repositories, and 211 forks carried the same exposed credentials. When including shared settings, history, and chat logs, the total number of exposed secrets rises to 2,539 across 1,994 repositories.

Anthropic's Silence on the Issue

Despite the severity of the data, Anthropic has not issued a public response. The original GitHub issue, #5544, was closed by a bot on January 3, 2026, with the message "This issue has been automatically closed due to 60 days of inactivity," labeling the fix as "not planned." This lack of engagement forces developers to implement their own mitigations. Apiiro recommends rotating all exposed keys immediately, as a secret that has been public is considered burned regardless of history rewriting. Developers should also audit their repositories using git ls-files and git log to identify tracked local settings files.

Key Takeaways

  • Claude Code stores approved commands with literal secrets in plain text within .claude/settings.local.json.
  • 215 secrets bypassed both Gitleaks and TruffleHog because they lacked standard provider prefixes.
  • Global git ignore rules do not protect CI environments or fresh clones, leading to accidental commits.
  • Anthropic closed the relevant bug report as "not planned" after 60 days of inactivity.

The Bottom Line

Anthropic’s failure to address this bug reflects a dangerous prioritization of user convenience over security hygiene. Until the default behavior changes, developers must treat AI agent config files as sensitive as .env files and never approve commands containing literal credentials.