Apiiro reports secrets in public Claude Code settings on GitHub

On November 7, 2026, The Hacker News reported that security company Apiiro found 1,122 public copies of Claude Code’s .claude/settings.local.json file containing at least one secret. The reported mechanism is straightforward: when a user approves one exact shell command with “Yes, and don’t ask again,” the command can be saved as an allow rule, including any password or token typed directly into it. Apiiro did not test whether most of the exposed credentials still worked; one company contacted by the researchers confirmed its key had been live.

Rotate affected credentials before cleaning up files: Git history and repository forks may preserve copies after the current file is removed.

How an approved command can preserve a secret

A persistent approval can save the full text of an exact command in .claude/settings.local.json. If that command contains a literal secret, the value can end up in the file in plain text. An allow rule can also use a pattern, which need not contain a secret.

Claude Code reportedly adds the local settings file to the user’s global Git excludes when it first writes the file in a Git repository. That exclusion applies to the user’s own Git setup; it does not remove a file already committed or give the repository a shared .gitignore rule. A committed copy can remain in Git history or forks even after the current file is deleted.

What Apiiro’s reported counts include

Apiiro reported searching 104,185 public copies across 103,617 repositories. It found at least one secret in 1,122 copies and counted 1,379 secrets in those current public settings.local.json files. The Hacker News reported the findings and their scope as follows:

The broader figure covers more than the current local-settings files, so it describes a different scope. Apiiro also reported 734 secrets in older versions across 509 repositories and copies of the same secrets in 211 forks of 74 repositories.

What the scanner results say

Apiiro reported running gitleaks and TruffleHog against the 1,122 secret-bearing files without using either tool’s verification step. The reported results were:

Apiiro’s reported response starts with searching current files and Git history, then rotating affected credentials before cleanup. After rotation, its recommendations include untracking the file, adding a repository-level .gitignore rule, removing local rules that contain literal secrets, using secrets-manager variables instead of typing secrets into commands, and favoring command patterns over exact commands.

File-read rules address a different risk

A Claude Code community discussion quoting the product’s guidance describes Read deny rules as a way to block access to sensitive paths and says .claudeignore does not control file-tool access. That kind of rule concerns file reading; it does not remove a secret already saved in an approved command or a copy retained in Git history.