Secrets Found in 1,122 Claude Code Settings Files

Security firm Apiiro published its findings on November 5. After reviewing 104,185 personal Claude Code settings files uploaded to public GitHub repositories, the company said it found secrets such as passwords in 1,122 of them. The culprit, according to Apiiro, is the convenience feature that spares users from re-approving the same command: it can leave those values sitting in the file.

What gets saved when you click “don’t ask again”

Claude Code takes a command the user has approved, turns it into a rule, and records it in a personal settings file inside the project. According to Apiiro, if the command itself contains a password or an authentication value written out in the clear, that value ends up in the file too. Once the file is pushed to a public repository, anyone else can read it.

For that to happen, the file has to make it into the repository in the first place. Anthropic’s documentation says that when Claude Code first creates this file inside a Git repository, it adds the file to the user’s global exclude list. That list is not the same as the exclude settings that travel with the repository. Apiiro pointed out that in a repository cloned onto a different machine, or in a folder that only later becomes a Git repository, the file can be included as is.

What turned up in the 1,122 files

Across the 1,122 personal settings files that are public today, Apiiro classified 1,379 distinct secrets. It counted 63 affected organizations. When the company widened its scope to include past Git history, shared settings files, and session transcripts, it said it found 2,539 distinct values across 1,994 repositories.

Apiiro also reported cases that automated scanners missed. The company said it ran two widely used secret detection tools against the files, and that 215 files were flagged by neither. The research team did not attempt to log in with the credentials it found, nor did it test whether they were still valid.

What users in South Korea should check

South Korea is among the countries where Claude is available. Anthropic has publicly stated that Korean developers are using Claude Code. Users in the country should review the permission rules they saved to make approvals easier. If a command approved with “don’t ask again” contains a password, it stays in the settings file, and uploading that file to a public repository can expose the password along with it.

By default, Claude Code asks the user for permission before running a command or modifying a file. Anthropic says it has also shipped a sandbox, a separate execution environment, along with auto mode, both aimed at cutting down on repeated approvals. Apiiro said that after comparing the documentation for 16 coding AI tools, Claude Code was the only one it found that writes the full text of an approved command into a project file by default.

Apiiro said it shared its findings with Anthropic before publication. According to Apiiro, Boris Cherny, who leads Claude Code, responded that the company would look into ways to reduce the problem and could pilot basic secret detection. The next question is what improvements are actually applied to secret detection and to how these values are stored.