Apiiro has identified public GitHub copies of Claude Code’s local settings file containing credentials saved inside command approvals. Its November 5 research classified 1,122 of 104,185 examined files as holding secrets, comprising 1,379 distinct values.
The mechanism starts on the developer’s machine. According to Apiiro, choosing “Yes, and don’t ask again” can preserve the exact approved command in .claude/settings.local.json, including an embedded password or token. Publication occurs when that file is committed or otherwise shared.
The researchers did not test the credentials or contact the associated hosts. One notified company confirmed that its key had been live. The figures therefore measure classified exposure, rather than demonstrated unauthorized account access.
This makes the saved approval itself a useful audit target. A developer may have reviewed a command for whether it should run without noticing that its contents would become a reusable local permission rule.
What the current ignore protection covers
Current Anthropic documentation says Claude Code writes standing Bash approvals as allow rules in the local file. On the first write inside an existing Git repository, it adds **/.claude/settings.local.json to the user’s global Git excludes if needed. A file created manually needs an explicit ignore rule until Claude Code writes it.
That protection has a defined scope. The Git manual explains that ignore rules do not affect files already tracked. It also distinguishes a user’s global excludes from a repository .gitignore, whose rules travel with clones. Check both the effective exclusion on each machine and whether the local file has already entered version control.
A user report opened in August 2025 described plaintext credentials in approved commands. That issue was closed automatically for inactivity in January 2026. The closure is not evidence that the behavior was patched.
Apiiro does not identify a fixed Claude Code version. Its 2,539-secret total includes history, shared settings and transcripts.
Rotate exposed credentials before repository cleanup
For an exposed credential, GitHub recommends revocation or rotation first. Repository cleanup then needs coordination because earlier copies may remain in forks, clones, cached views and pull requests. Rewriting history has operational side effects and does not remove copies held by other users.
A focused review should identify secret-bearing approval rules, check current files and repository history, and establish which credentials need replacement. Review the deliberately shared .claude/settings.json separately: it serves a different purpose from the local override. Future approvals should keep literal secrets out of command text wherever the application can obtain them through a protected runtime mechanism.
