Claude Code Settings File Leaks Passwords and API Keys in 1,122 Public GitHub Copies

Passwords and API keys that developers typed into commands approved in Claude Code are exposed in public GitHub repositories, according to security company Apiiro.

When a user chooses "Yes, and don't ask again," Anthropic's AI coding assistant can store the command word-for-word, secret included, in a project settings file called .claude/settings.local.json. Apiiro said yesterday that 1,122 public copies of the file contain at least one secret, though it did not test whether any still work. One company the researchers notified earlier this week confirmed its key had been live.

Deleting the file does not undo the leak, because older versions remain in git history and in repository forks. The researchers advise rotating first: change every password, token and key the file has ever held, then clean up.

Apiiro found 104,185 copies of the file across 103,617 repositories, with about 1.1% holding at least one secret - 1,379 secrets in total. More than a third open a database directly, including 379 database passwords, alongside 43 SSH logins, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. Among the owners are 63 organizations, mostly software companies. As of Monday, every file with a secret was still on its repository's default branch, and in half of those repositories it had been there for at least 217 days.

The researchers say Claude Code is the only one of 16 coding agents they compared that is confirmed to save the full approved command in a project file by default. Common secret scanners missed many of the files: gitleaks flagged 564 of the 1,122 and TruffleHog 643, with neither flagging 215. Earlier user bug reports about the behavior were closed by an automated bot without a reply from Anthropic, the researchers say.

Source: The Hackers News