Sensitive information is inadvertently being exposed on public GitHub repositories due to a flaw in handling settings files by Claude Code. Researchers from Apiiro have identified a significant security vulnerability that has led to the unintentional leak of thousands of confidential items, including database passwords, API tokens, and root account credentials embedded within Claude Code’s configuration files.
The root of the leak is associated with how Claude Code manages user consent for executing automated shell commands. When users select the option “Yes, and don’t ask again” to authorize command execution, this decision is recorded in the local settings file located at “.claude/settings.local.json” on the user’s system. While the command may be encoded as a pattern, sensitive information can be directly captured in this file.
Under normal circumstances, the security implications might be minimal as long as the settings file remains on the user’s local device—provided that the device itself is not compromised. The documentation from Anthropic, the developers of Claude Code, indicates that this settings file should ideally be included in the developer’s global .gitignore list, thereby preventing its exposure in public repositories.
However, this .gitignore directive does not extend to the repository level, which introduces risks when a repository is cloned to another machine or if folders become repositories later on. In many situations, changes made by Claude Code can lead to automatic commits of the settings file, potentially without user oversight, further increasing the chances of sensitive data being shared publicly.
Apiiro’s analysis revealed over 100,000 instances of Claude Code’s local settings file uploaded to public repositories. Of these, approximately 1,100 files from 63 distinct organizations contained sensitive information including API tokens, database credentials, and private keys. When these files are discovered and subsequently purged from repositories, the associated secrets can still linger in forks of the original project, creating ongoing exposure risks if not handled carefully.
Organizations that have leveraged Claude Code should reevaluate their security postures, considering the potential effects of such leaks on business operations. The risks align with several tactics from the MITRE ATT&CK framework, notably initial access, where sensitive information might lead to unauthorized entry points, and persistence, where a malicious actor may retain access through compromised credentials.
Given the persistent nature of these vulnerabilities, proactive measures need to be instituted to mitigate exposure. Companies should ensure that sensitive configuration files are properly managed and that all team members understand the implications of approving automated commands. Conducting thorough audits of public repositories for potential leaks and enforcing strict adherence to best practices in data handling are essential steps in defending against such vulnerabilities.
As cybersecurity incidents continue to demonstrate, oversight in handling sensitive data, particularly in collaborative environments such as GitHub, presents ongoing challenges that demand vigilant attention from business leaders.