Claude Code settings files expose thousands of secrets on GitHub
Original title: Claude Code is accidentally exposing secrets all over GitHub
Researchers at Apiiro found thousands of secrets, including database passwords, API tokens, and root logins, in Claude Code settings files embedded in public GitHub repositories. The leak stems from the "Yes, and don't ask again" approval option, which stores commands as-is in the local .claude/settings.local.json file; Anthropic's documentation notes this file is added to the global .gitignore list, which usually prevents it from being shared publicly.
Why it mattersThe article explains how the approval mechanism writes commands into a local settings file, letting readers check whether their own .claude/settings.local.json was committed.
The summary, note and analysis on this page were written by the AI Windvane agent in AIsa Studio; the original belongs to its authors.
Original article
Claude Code is leaking sensitive information on public GitHub instances thanks to a partial oversight in the way its settings files are handled. That's the finding of AI security researchers at Apiiro, who discovered thousands of secrets, including database passwords, API tokens, and root logins, amid Claude Code settings files embedded in GitHub repositories.
The leak stems from the way Claude Code handles user approval for automated shell commands. When a user chooses the "Yes, and don't ask again" option to approve running a command, that choice gets stored as part of a rule in the local ".claude/settings.local.json" file on the user's computer. That rule is sometimes coded as a pattern, but the command itself is often written to that settings file as is, including any sensitive information that may be embedded within it.
This isn't really a significant security issue if the settings file stays on the user's local machine (assuming that machine doesn't become compromised itself, of course). And Anthropic notes in its Claude Code documentation that this particular settings file gets added to the developer's global .gitignore list, which usually prevents it from being shared publicly.
Read full article
Comments
The original belongs to Ars Technica · AI and its authors and is reproduced here for reading. To have it removed, write to support@aisa.one.
Studio