More than 1,100 Claude Code files exposed passwords on GitHub

When you use the coding tool Claude Code and click "Yes, and don't ask again," the program saves the approved command verbatim in a local file. If the command contains a password or a key, it ends up in the file too. That is the finding of a study by security firm Apiiro, which researchers Shmulik Cohen and Matan Giladi published on November 5, 2026.

The file was supposed to be private

The file is named .claude/settings.local.json and is meant for personal settings, not something to be shared with the rest of the project. But if it is committed (saved to the project's history) and pushed to a public repository on GitHub, the secrets go with it.

Apiiro examined 104,185 public copies of the file, with data collected November 1-3, 2026. In 1,122 of them (1.1 percent), the firm found at least one real secret, for a total of 1,379 distinct values.

In a broader study that also covered git history and other files, Apiiro found 2,539 distinct secrets in 1,994 repositories. A total of 63 organizations were affected, mostly software companies.

What was leaked?

The findings included 379 database passwords, 122 Supabase service-role keys and 43 SSH logins, some with root passwords. There were also production tokens, for example for Square, Azure PostgreSQL passwords and access credentials for a medical records database. According to Apiiro, the default branches held a smaller number of GitHub, GitLab and npm tokens (42) and AWS keys (23).

Scanning tools that look for leaked secrets caught far from all of them. Gitleaks flagged 564 of the 1,122 files, and TruffleHog flagged 643. Neither found 215 of the files. Passwords in formats such as PGPASSWORD= and sshpass -p often slipped through.

Apiiro also found 539 repositories where commits co-authored by Claude changed settings files. According to the report, as relayed by RuntimeWire, coding agents now write persistent permission files in project folders, so a routine approval can turn into a decision to store a password.

An old problem and Anthropic's response

The problem was first reported in August 2025, and that case was automatically closed in January 2026. Security firm ironPeak published similar findings in February 2026.

Anthropic says that on first use in a repository, Claude Code adds the file to Git's global exclude list. However, that list does not travel with the project the way a committed .gitignore does.

Simply deleting the file afterward does not help either, because older versions remain in git history and forks (other people's copies of the project).

Apiiro's advice

Apiiro recommends revoking or rotating exposed secrets, meaning creating new ones, before deleting the files. You should also review agent folders and git history and use a repository-level .gitignore. In addition, you should use secret managers or environment variables instead of commands with plaintext passwords.

The figures are based on Apiiro's own methodology and its judgment of what counts as a real secret. The sources do not make clear how many of the secrets were still active.