claude code settings leak: 1,122 Public GitHub Files Hold Secrets

The claude code settings leak is less a hack than a habit trap. Security firm Apiiro reported this week that Claude Code's "Yes, and don't ask again" option can save an approved shell command word for word in a project file, including any password or token typed into it, and that 1,122 public GitHub copies of that file hold at least one secret. Anthropic's Boris Cherny has acknowledged the issue on Hacker News, according to iTnews, and the company is reportedly looking at fixes.

What actually happened

Claude Code asks before running most shell commands. If a developer picks "Yes, and don't ask again," it writes an allow rule to the settings file inside the project, as The Hacker News describes from Anthropic's permissions documentation. Sometimes the rule is a pattern, such as "npm test *." Sometimes it is the exact command. When it is the exact command, a password in that command is saved in plain text.

Apiiro says it reproduced the behavior with Anthropic's current models, Opus 5.5 and Fable 5.1, and iTnews stresses that this is a property of Claude Code, not of the model. The tool does try to protect the file: the first time it writes it in a git repository, it adds the file to the user's global git excludes. But that exclusion lives on one machine. It does not travel with the repository, and Claude Code does not add the file to the project's own .gitignore.

The numbers

According to The Hacker News, Apiiro's search of public GitHub found 104,185 copies of the file. About 1.1% held a secret that matched a known format or sat beside a public server address, with an AI reviewer also agreeing. More than a third opened a database directly. iTnews adds 122 Supabase service-role keys to the list, and The Hacker News says 63 organizations, mostly software companies, own some of the files.

Researchers did not test whether the secrets still work, though one notified company confirmed its key had been live. As of Monday, every file with a secret was still on its repository's default branch, and in half of those repositories it had been there for at least 217 days. In 539 of 1,105 traced repositories, a commit listing Claude as co-author changed the file, which suggests the tool itself often commits it.

Why scanners missed it

Apiiro also ran two popular scanners, gitleaks and TruffleHog, without verification. Of the 1,122 files, gitleaks flagged 564 and TruffleHog 643, and neither flagged 215. The reason is simple: most of the misses were passwords typed into commands. A password after PGPASSWORD= or mysql -p looks like an ordinary word to a tool that hunts for key formats.

Apiiro's wider count, including the shared settings.json file, older versions and saved chat logs, reaches 2,539 secrets across 1,994 repositories. And it is not new: The Hacker News says a user filed a similar bug report on August 11, 2025, which an automated bot closed as "not planned" after 60 days of inactivity, and the researchers say four related reports were closed the same way, without a reply from Anthropic.

What it means for AI coding tools

Approval fatigue is real, and "don't ask again" exists because nobody wants to click yes fifty times. The lesson is that any agent that remembers your commands also remembers what you typed in them. Apiiro says that of 16 coding agents whose documentation it compared, Claude Code is the only one confirmed to save the full approved command in a project file by default. If you use other agents, check their folders too, because Apiiro recommends treating directories such as .claude, .cursor and .gemini like .env files.

We have covered the tooling around the assistant before, in claude duet mobile and unslop claude skill. This one is about the plumbing underneath.

What to do as a reader

If you use Claude Code, do the checklist from Apiiro and The Hacker News, in this order. Rotate any password, token or key that ever appeared in a command you approved. Then run git rm --cached .claude/settings.local.json and add it to the repository's own .gitignore. Open the file on your own computer and delete every rule that contains a secret. Keep secrets in environment variables or a secrets manager so a saved rule holds a variable name, not a value, and approve patterns instead of single commands.

Read The Hacker News write-up and the Claude Code settings docs to check how the file works. The claude code settings leak is fixable on your side today, whatever Anthropic ships next. Nothing here is investment advice.