AI Coding Assistant Setting Is Leaking Passwords and Keys onto Public GitHub

Passwords and API keys typed into commands that developers approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. Security company Apiiro reports that when a user selects "Yes, and don't ask again", the assistant can save the exact command, secret included, in plain text in a project file called .claude/settings.local.json. Apiiro found 104,185 copies of the file across 103,617 public repositories. About 1.1%, or 1,122 copies, hold at least one secret, and together they contain 1,379 different secrets.

Apiiro did not test whether the secrets still work, but one company it notified confirmed its key was live. Claude Code tries to keep the file out of git by adding it to the user's global git excludes. However, that protection stays on one computer and does nothing for a file already committed. The tool also does not add the file to the project's own .gitignore. In 539 of the 1,105 repositories the researchers traced, a commit listing Claude as co-author changed the file, which suggests Claude often commits it itself.

Deleting the file does not undo the exposure, because older versions remain in git history and in forks. The researchers advise rotating first: change every password, token and key the file has ever held, then clean up.