On November 2, 2026, a security researcher alerted a database vendor to a critical exposure: its admin-level cloud API key was sitting in a public GitHub repository. The culprit wasn't a careless intern pasting a key into a README, but a single click of the "Yes, and don't ask again" button in Claude Code. This action saved the raw command, credential and all, into .claude/settings.local.json, a file that Anthropic’s documentation claims is kept out of Git but often isn't in practice.

The Scale of the Leak

Apiiro’s scan of every public copy of .claude/settings.local.json on GitHub uncovered 104,185 files across 103,617 repositories. Of these, 1,122 files contained real secrets. When including Git history, shared settings, and agent transcripts, the total reaches 2,539 distinct secrets across 1,994 repositories. The leaked data is not trivial: it includes 379 database passwords, 122 Supabase service-role keys, and 43 SSH credentials, some of which were root passwords embedded directly in sshpass commands.

Why Standard Scanners Missed It

The most alarming finding for security teams is the failure rate of existing tools. Apiiro ran gitleaks and TruffleHog over the dataset; gitleaks flagged only 564 of the 1,122 affected files, and TruffleHog caught 643. Roughly one in five files with a real secret was missed by both scanners. The gap is structural: standard scanners look for provider-specific key formats (like AWS prefixes or high-entropy strings), but they do not detect ordinary passwords embedded in command-line arguments like PGPASSWORD= or mysql -p.

The Default Behavior Trap

The leak mechanism is a perfect storm of convenience and misconfiguration. Claude Code saves the literal command string, including the secret, as a permanent rule in the local settings file. While Anthropic adds this file to the developer's global Git ignore list, this protection does not travel with the repository. If a project is copied to a new machine, initialized as a new repo, or if the file was previously tracked, the secret gets committed. Worse, in 539 of the affected repositories, the commit was co-authored by Claude itself, meaning the agent that wrote the rule also committed it.

Immediate Remediation Steps

Developers must treat agent folders as secret-bearing directories, similar to .env files. The audit process requires more than just deleting the current file; it requires purging Git history. Teams should immediately add .claude/settings.local.json to their repository’s .gitignore to ensure protection travels with the code. For existing leaks, rotation is mandatory before cleanup, as forks and clones persist. A simple grep for patterns like PGPASSWORD= or Authorization: Bearer in the .claude/ directory can reveal what regex-based scanners miss.

Key Takeaways

  • 2,539 distinct secrets were found in public GitHub repositories via Claude Code permission files.
  • Standard secret scanners (gitleaks, TruffleHog) missed approximately one in five leaked credentials because they were embedded in command strings.
  • The "don't ask again" feature saves literal commands with secrets into .claude/settings.local.json, which is not safely ignored by default in all project setups.
  • In nearly half of the affected repos, Claude Code itself committed the file containing the secret.
  • Remediation requires rotating keys first, then cleaning Git history, as deleting the file from the current branch is insufficient.

The Bottom Line

Convenience in AI agents is currently a security debt. Until tools generalize permissions to patterns rather than literal commands, developers must manually scrub their .claude/ directories or face an audit nightmare.