Apiiro Researchers Find 2,539 Leaked Secrets in Claude Code Local Settings on GitHub

·2026.11.11 16:15

Key point

Security researchers identified 2,539 real secrets exposed in public GitHub repositories through the .claude/settings.local.json file.

Apiiro security researchers discovered 2,539 real secrets leaked on public GitHub via Claude Code's .claude/settings.local.json file.
The leak occurs when users approve a command with the "Yes, and don’t ask again" option, which saves the exact command, including any passwords or keys, to the local settings file.
Remediation requires removing the file from Git history using git log and git rm --cached, then adding it to .gitignore.
Developers must rotate any exposed secrets immediately, as deleting the file does not remove them from history, forks, or clones.

This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.

Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.