I use AI coding tools in my own work, so this one got my attention fast. It is not a hack of a model and it is not prompt injection. It is a convenience button doing exactly what it says \u2014 remembering a command so it does not have to ask again \u2014 and writing that command, password and all, into a file inside your project. Researchers found more than a thousand copies of that file in public GitHub repositories, with real secrets inside. If you use Claude Code, check your repos today.<\/p>\n
Claude Code is Anthropic’s terminal coding assistant. By default it asks before running most shell commands. If you pick “Yes, and don’t ask again,” it saves an allow rule in .claude\/settings.local.json inside the project, according to its permissions documentation. Later sessions then run matching commands without asking.<\/p>\n
Sometimes that rule is a pattern, and sometimes it is one exact command. When it is the exact command, any password or token typed into it is saved too, in plain text. Ask the tool to check a database and the command it proposes will often carry the password with it. Approve it once with “don’t ask again” and you have stored that password in a JSON file in your project folder.<\/p>\n
Security firm Apiiro published the research on November 5, and The Hacker News reported it on November 7. Apiiro searched public GitHub and found 104,185 copies of the file in 103,617 repositories. About 1.1 percent of them \u2014 1,122 copies \u2014 hold at least one secret. Together those current copies hold 1,379 different secrets.<\/p>\n
Counting older versions, the shared settings file, and saved agent chat logs, Apiiro puts the total at 2,539 secrets across 1,994 repositories. More than a third of the secrets in the current files open a database directly, including 379 database passwords, plus 43 SSH logins, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. They say 63 organizations own these files, and the strongest cases include a database vendor’s admin-level cloud key and the owner password of a medical-records database.<\/p>\n
For the people affected, this is serious, but I want to be precise. Apiiro did not test any of the credentials, so this proves exposure, not that every key still works. One company the researchers notified did confirm its key had been live. That is enough to treat any secret in one of these files as compromised until you rotate it.<\/p>\n
The protection meant to prevent this does not travel. The first time Claude Code writes the file in a repository, it adds it to your global git excludes, so git on that one computer ignores it. It never adds the file to the project’s own .gitignore. Clone on another machine, or turn a folder into a repo later, and the file can be committed like any other. In 539 of the 1,105 repositories Apiiro traced, a commit listing Claude as a co-author changed the file \u2014 the assistant itself often commits it.<\/p>\n
Time makes it worse. Every file with a secret was still on its repository’s default branch in the researchers’ snapshot, and in half it had been there at least 217 days. Older versions hold another 734 secrets, and 211 forks carry the same secrets. Deleting the file today does not clean history or forks.<\/p>\n
Your scanner may not save you either. Gitleaks flagged 564 of the 1,122 files and TruffleHog flagged 643, but 215 were flagged by neither \u2014 most misses are passwords inside commands, where a password looks like an ordinary word. Users had also reported this before: a bug report from August 11, 2025, said the same thing, was closed by a bot as “not planned” in January, and the researchers say the related reports got no reply from Anthropic. I have seen no public response from Anthropic in the reporting I read.<\/p>\n
First, search. Look in your GitHub account and any organization you belong to for .claude\/settings.local.json and for .claude\/settings.json, and check git history too, even where the file is now gone. Secrets also turned up in 298 of 76,011 public copies of that shared settings file.<\/p>\n
Second, rotate first, clean up second. Change every password, token and key those files have ever held before you tidy the repo. Removing the file does not undo a leak that reached a public repo or a fork.<\/p>\n
Third, untrack and ignore it properly. Stop tracking the file and add it to the project’s own .gitignore, so protection travels with the project.<\/p>\n
Fourth, clean your local copy even if you never committed it, and delete every rule containing a secret. The researchers note that plain JSON file can also end up inside a package, a Docker image, a zip, or a synced folder. Fifth, keep secrets out of commands: reference them as variables from a secrets manager, so a saved rule holds the variable name, not the secret, and approve patterns instead of exact commands where you can.<\/p>\n
My bottom line: AI tools that remember what you approved will remember your passwords too if you let them. Treat agent settings folders the way you treat .env files \u2014 assume they hold secrets, keep them out of git in the repo itself, and rotate anything that ever landed in one.<\/p>\n