Apiiro reportedly found real secrets in 1,122 public copies of Claude Code’s .claude/settings.local.json file, among 104,185 copies examined across 103,617 repositories. Ecosistema Startup’s November 8, 2026, summary of Apiiro’s research, which it dated November 5, said all 1,122 files were on their repositories’ default branches as of November 2.
What Apiiro’s reported scan counted
The 1,122 files reportedly contained 1,379 distinct secrets. A separate, broader tally was 2,539 secrets across 1,994 repositories; that count included Git history, shared settings files and agent chat transcripts. These figures describe different sets of material.
The summary also said that, among the 1,122 files, gitleaks flagged 564 and TruffleHog flagged 643, while both missed 215. Those are results attributed to Apiiro’s scan, not a general measure of how often secret scanners miss credentials.
How an approved command can save a credential
The reported exposure path starts with a shell command that contains a literal password or token. When a user approves a command with “Yes, and don’t ask again,” Claude Code can save the approved command in the project’s .claude/settings.local.json file. If the file is committed to a public repository, the credential in that command can go with it.
Ecosistema Startup’s account also said Claude Code may add the file to a user-level global Git exclusion when it is created inside an existing Git repository. That is separate from the project’s .gitignore: the summary said Claude Code does not add the file there.
If a credential reaches a public repository, deleting the current file is not enough. Rotate the credential, then account for its repository history and forks.
Why repository history matters
Removing a file from the current project copy does not erase earlier commits or copies in forks. Apiiro’s findings, as summarized by Ecosistema Startup, included the same secrets in 211 forks of 74 repositories, plus 734 additional secrets in older versions across 509 repositories. The summary reported a median of 217 days between a file’s first commit and the study’s observation; 118 repositories had retained such files for more than a year.
The default-branch finding was a snapshot dated November 2, 2026. It describes the files’ status on that date.
GitHub Actions describes a different risk
A separate discussion by Cloudanix concerns Claude Code running in GitHub Actions workflows that process untrusted issue or pull-request content while holding secrets or repository permissions. That workflow scenario is distinct from a credential saved in a local project settings file, and it does not corroborate Apiiro’s scan counts.
