November 7, 2026 – Developers who approve shell commands in Anthropic’s Claude Code may be saving live credentials in a file that ends up on public GitHub, according to new research from security firm Apiiro.

How the leak happens

By default, Claude Code asks before running most shell commands. If the developer chooses “Yes, and don’t ask again,” the tool saves an allow rule in .claude/settings.local.json inside the project. That rule contains the exact command, word for word.

If the command included a live secret, such as a database connection string or an API token, the secret is now stored in plain text. If the file is later committed and pushed, it becomes public.

What Apiiro found

Researchers Shmulik Cohen and Matan Giladi examined 104,185 public copies of the file across 103,617 GitHub repositories. About 1.1% of them, or 1,122 files, contained at least one real secret, for 1,379 distinct credentials in total.

• More than a third of those secrets gave direct access to a database, including 379 database passwords and 122 Supabase service-role keys.
• Other exposed credentials included SSH logins, cloud keys such as AWS, and repository tokens.
• Checking Git history turned up 734 more secrets across 509 repositories that no longer appear in any current copy of the file, usually because it was later deleted.
• Counting Git history, shared settings files, and saved agent transcripts, Apiiro tallied 2,539 secrets across 1,994 repositories.
• Gitleaks and TruffleHog together missed 215 of the 1,122 affected files, so a clean scan isn’t proof of safety.

Why Git’s protections don’t catch it

Claude Code does try to keep the file out of version control. The first time it writes the file inside a repository, it adds an entry to the developer’s global Git excludes. But that rule lives on the developer’s machine, not in the project’s .gitignore, so it doesn’t travel with the repository. A developer who force-adds the file, uses a different machine, or works from a fresh clone can commit it without any warning.

The behavior isn’t new. A bug report filed in August 2025 described approved commands with API keys being stored verbatim. Apiiro, which sells application and agent security products, says its research shows how widespread the problem has become.

What to do now

1. Rotate first. Before cleaning up any files, rotate every password, key, and token that may ever have appeared in an approved command.
2. Audit your repositories. Search public and private repos for .claude/settings.local.json and the shared .claude/settings.json, and check full Git history, not just the current branch.
3. Stop tracking the file. Run git rm --cached .claude/settings.local.json, then add the path (or the whole .claude/ folder) to the project’s .gitignore and to your organization’s repo templates.
4. Keep secrets out of commands. Reference environment variables from a secrets manager, such as $DB_URL, instead of typing raw credentials into the terminal.
5. Check other agent files. Apiiro also found secrets in saved agent conversations, memory files, and deployment notes, so review those too.

Sources: Apiiro research (published November 5, 2026), The Hacker News, ITWire.