Apiiro Finds 1,122 Public Repositories Leaking Secrets via Claude Code Settings

Details

Apiiro discovered 104,185 copies of .claude/settings.local.json in public repositories, with 1,122 files containing secrets.
The leak occurs because Claude Code stores approved shell commands in plaintext under permissions.allow, and the file is excluded only via personal global git excludes rather than the project .gitignore.
When repositories are shared or cloned by users without the personal exclude, the file can be committed, exposing any tokens or passwords typed into approved commands.
The issue affects other AI coding agents like Cursor, Copilot, and Gemini that use similar 'don't ask again' memory patterns.
Remediation requires rotating exposed secrets, as deleting the file entry does not remove them from git history.
The author maintains cfgaudit, an open-source tool that scans for hardcoded secrets in permission entries and verifies gitignore status across different agents.

Key point