On November 9, 2026, Ars Technica reported that Claude code settings files are accidentally exposing thousands of sensitive secrets, including database passwords, API tokens, and root logins, across public GitHub repositories due to a handling oversight.
Key takeaways
- AI security researchers at Apiiro discovered thousands of secrets leaking from Claude code settings files.
- The issue happens because user command approvals get saved directly into local settings files.
- Apiiro found over 100,000 cases of local settings files uploaded to public GitHub repositories.
- Out of those cases, about 1,100 files from 63 different organizations contained actual sensitive credentials.
What is the Claude code settings leak?
The security flaw stems from how the tool processes user approvals for automated shell commands. When users pick the option to approve a command and skip future prompts, that choice saves directly inside the local .claude/settings.local.json file. Commands often get written into this file verbatim along with any hidden sensitive details.
While the settings file usually stays safe on a local computer, problems start when repositories move. Anthropic notes in its documentation that the file belongs on a global ignore list, but that protection fails to reflect at the individual repo level. Apiiro points out that the software itself will sometimes commit settings changes without direct user input.
Risks in GitHub repositories
Files end up shared publicly when someone clones a project to a new machine or turns an ordinary folder into a repo later on. Even after someone finds and deletes the exposed files, the sensitive keys can still linger inside forks of the original project unless users take extra steps.
What happens next?
Developers who use the tool need to check their public and private projects for stray settings files that slipped past ignore rules. Organizations should review their code history and forks immediately to revoke any exposed database passwords, API tokens, or root logins discovered by researchers.
Frequently asked questions
Apiiro discovered thousands of exposed secrets in settings files, which include database passwords, API tokens, root logins, and private keys.
AI security researchers at Apiiro discovered that settings files were leaking sensitive information on public GitHub instances.
The global ignore list setting does not always apply at the repository level, and the software sometimes commits settings changes automatically without user input.
Apiiro researchers found over 100,000 instances where local settings files had been uploaded to public GitHub repositories.
Out of more than 100,000 uploaded settings files, about 1,100 files originating from 63 different organizations contained actual sensitive secrets.
Based on reporting by Ars Technica. Read the original article
