Claude Code settings files exposed credentials in public GitHub repositories

AI · First reported 9 Nov, 17:24 · Updated 18:25

Image: Wikimedia Commons · NASA/USGS · Public domain

Researchers at Apiiro found that Claude Code’s local settings file can retain sensitive command-line data and, in some cases, be uploaded to public GitHub repositories. Anthropic is considering changes, while researchers advise checking repositories and rotating exposed credentials.

When users approve a shell command and choose not to be asked again, Claude Code may save the command in .claude/settings.local.json, including any password or token in it.
Apiiro found more than 100,000 copies of the settings file in public repositories; reports specify that roughly 1,100 to 1,122 contained real secrets.
Anthropic is considering safeguards, and Apiiro recommends changing credentials that may have been exposed because deleting a file may not remove copies in Git history or forks.

Summary written by Lux AI from 2 articles

Key facts

Researchers: Apiiro
File involved: .claude/settings.local.json
Copies found: More than 104,000 in public GitHub repositories, according to the centre report.
Files containing secrets: 1,122, according to the centre report; the left report gives about 1,100.
Distinct credentials: 2,539 across nearly 2,000 repositories, according to the centre report.
Possible Anthropic measures: Built-in secret scanning and changes to command permissions are under consideration.