If you use Claude Code and have ever tapped “Yes, and don’t ask again” on a command that contained a password, check your repositories today. Apiiro, an application-security company, says almost 2,000 public GitHub repositories contain credentials that this shortcut wrote into a project file.
Its count is 2,539 distinct secrets spread over 1,994 repositories and 63 organisations, mainly software firms. The file at fault is .claude/settings.local.json, where Claude Code keeps the commands you have approved for good. When the approved command had a password or token typed into it, the secret became part of the stored permission, and a careless commit published it.
One company confirmed to Apiiro that the key it had exposed still worked. One leak gave the owner login to a medical-records database.
Apiiro’s method was to scan 104,185 public copies of the file, gathered from 1 to 3 November. About 1,100 of them held real credentials. Going back through older commits, shared settings and saved conversations lifted the total to the 2,539 figure. Most were database access: 379 passwords and 122 Supabase service-role keys. The rest were cloud keys, private keys, registry tokens and 43 SSH logins, a few of them root.
Claude Code does add the file to a global Git ignore list the first time it creates it. Apiiro argues that this is not enough, because the list lives on one developer’s machine rather than in the project, ignores files that are already tracked and can miss a folder that is turned into a repository afterwards. Secret scanners were no great help either. Gitleaks caught 564 of the files and TruffleHog 643, while 215 slipped past both, since a password after sshpass -p or in an HTTP header has no telltale shape.
What to do: revoke and replace any credential that appears, before you delete anything, because it stays in Git history. Then run git rm –cached on the settings file, add it to .gitignore, look through the shared .claude/settings.json as well, and keep passwords in a secret manager that commands refer to by name. Apiiro adds that the same plaintext approvals, conversation logs and memory files are easy pickings for malware on a hacked laptop, not only for people browsing GitHub.
Plaintext credentials in approved commands were raised as a problem in a GitHub issue back in August 2025, according to the report. It does not quote any reply from Anthropic, whose settings documentation does say approvals are saved in that local file.
