Apiiro research published November 5, 2026; public GitHub data collected November 1 to 3, 2026
One Click, Saved Word for Word: Claude Code Approvals Left Secrets in 1,122 Public GitHub Files
Security firm Apiiro reported on November 5 that a routine permission choice in Claude Code, Anthropic AI coding assistant, has left real credentials in public view. When Claude Code asks to run a Bash command and the developer chooses Yes, and do not ask again, it saves that approval as an allow rule in .claude/settings.local.json inside the project folder, and Apiiro reports the rule is the complete command word for word, not a redacted pattern. A command that carried a database password or an API key inline therefore stores that secret in plaintext in the project tree. Apiiro examined 104,185 public copies of the file in 103,617 repositories collected between November 1 and 3 and classified 1,122 of them, about 1.1 percent, as containing secrets, holding 1,379 distinct values; counting git history, the shared settings file and saved agent transcripts, it puts the total at 2,539 secrets across 1,994 repositories affecting 63 organizations. The examples are production grade: a database vendor own admin-level cloud key, a production Azure PostgreSQL password, a Square production token and the owner password of a medical-records database, with 379 database passwords among the finds. The protection that exists does not travel: Claude Code adds the file to the developer global git excludes file the first time it writes it, which lives on one machine, never enters the project own .gitignore, and does not affect a file git already tracks. Generic scanners miss much of it, with gitleaks flagging 564 of the 1,122 files and TruffleHog 643, and 215 flagged by neither. In the median leaking repository the file had been public for 217 days before the November 2 snapshot. Two limits keep the finding honest: Apiiro did not test the credentials, so exposure is proven and compromise is not, and one notified company confirmed its key was live. The behavior itself is not new; users reported it on the Claude Code tracker as early as August 2025.
Executives
The risk here is not a model misbehaving; it is a convenience feature turning approval history into a credentials file that follows the code wherever the code goes. Any team using AI coding agents now has a new place where production secrets can sit in public. Ask for one number this week: how many of your public and private repositories contain .claude/settings.local.json or .claude/settings.json in their history, and for every secret found, proof that it was rotated, because deleting the file does not retire the credential.
CIO / CISO
Set the policy while the cleanup runs. Prohibit secrets on command lines in agent workflows; credentials reach commands through environment variables or a secrets manager so a saved rule holds a variable name, not a value. Require a project .gitignore entry for agent settings files in every repository template, since the vendor protection is a per-machine exclude that does not travel with the repo. Add agent configuration directories to your secrets scanning scope and your incident definition: a pushed settings file with a live key is an exposure incident with rotation first and history cleanup second, in that order.
Engineers
Run the search before you theorize. List tracked copies with git ls-files and search full history across branches, because the median exposure here was 217 days and every leaked file sat on a default branch. Read the permissions.allow entries for connection strings, authorization headers and password or token flags. If a secret was ever pushed publicly, rotate it at the provider first, then untrack the file, commit a project .gitignore entry, and purge history knowing forks and caches may keep copies. Until then, approve sensitive commands once per run instead of choosing do not ask again.
Everyone (non-IT)
If you use an AI coding helper for personal projects, the plain version is this: a button that stops the tool asking permission can also save the exact command, password included, into a file in your project, and uploading the project uploads the password. Keep passwords and keys out of the commands you type, check whether a .claude folder sits inside anything you have published, and if you find a key in a published file, change that key at the service itself rather than only deleting the file.