Anthropic’s Claude Code is inadvertently leaking sensitive credentials across the open-source ecosystem, according to a new report by security firm Apiiro. Researchers discovered that the AI coding assistant’s local configuration files, specifically .claude/settings.local.json, have been uploaded to public GitHub repositories with embedded secrets. These files contain high-value targets such as database passwords, API tokens, and root logins, turning convenience features into potential security liabilities for developers who aren’t paying close attention to their version control hygiene.

The 'Don't Ask Again' Trap

The root cause lies in how Claude Code handles user approvals for automated shell commands. When a developer selects the "Yes, and don’t ask again" option to streamline their workflow, the system stores this preference in the local settings file. While this reduces friction, it often writes the full command into the configuration, including any sensitive arguments passed along with it. Anthropic’s documentation correctly notes that this file should be added to the global .gitignore, but that protection fails when repositories are cloned across different machines or when a folder is initialized as a repo after the settings file has already been created.

Scale of the Exposure

Apiiro’s analysis revealed a staggering volume of these misconfigured files, identifying over 100,000 instances where the local settings file had been pushed to public GitHub repositories. While many of these files contained benign data, approximately 1,100 unique instances from 63 different organizations contained actionable secrets. These included private keys, public API tokens, and database credentials that could potentially allow attackers to access internal systems. The persistence of these secrets is particularly dangerous; even after a repository owner deletes the file from the main branch, the data often remains accessible in forks of the original project, creating a long tail of exposure that is difficult to scrub completely.

Key Takeaways

  • Convenience features like "don't ask again" can inadvertently persist sensitive command-line arguments in configuration files.
  • Global .gitignore rules do not always protect files in existing repositories or those cloned to new environments.
  • Over 1,100 exposed secrets were found across 63 organizations, highlighting a significant gap in developer security awareness.
  • Deleted secrets often persist in GitHub forks, making remediation a distributed and complex challenge.

The Bottom Line

This is a classic case of developer experience optimization outpacing security defaults. Anthropic needs to enforce repo-level ignore rules automatically, but developers must stop treating local config files as inherently safe from version control.