Claude Code is leaking sensitive information on public GitHub instances thanks to partial oversight in the way its configuration files are handled. That’s the finding of AI security researchers at Apiiro, who discovered thousands of secrets, including database passwords, API tokens, and root logins, among Claude Code configuration files embedded in GitHub repositories.
The leak arises from the way Claude Code handles user approval for automated shell commands. When a user chooses the “Yes, and don’t ask again” option to approve the execution of a command, that choice is stored as part of a rule in the local “.claude/settings.local.json” file on the user’s computer. That rule is sometimes coded as a pattern, but the command itself is often written to that configuration file as-is, including any sensitive information that may be embedded in it.
This isn’t really a major security issue if the configuration file remains on the user’s local machine (assuming that machine isn’t compromised, of course). And Anthropic notes in its Claude Code documentation that this particular configuration file is added to the developer’s global .gitignore list, which generally prevents it from being shared publicly.
But that .gitignore setting is not reflected at the repository level, meaning that the sensitive file can be accidentally uploaded if a repository is cloned to another machine or if a folder becomes a repository later, for example. In many cases, Claude Code will make changes to the configuration file without user intervention, Apiiro writes.
A breakdown of the types of secrets Apiiro found in publicly shared Claude Code configuration files.
A breakdown of the types of secrets Apiiro found in publicly shared Claude Code configuration files.
Credit: Apiiro
Apiiro researchers found over 100,000 cases where Claude Code’s local configuration file had been uploaded to a public GitHub repository. Of these, only about 1,100 from 63 different organizations contained secrets such as public API tokens, database passwords, or private keys. Even after these files are discovered and removed from a repository, secrets can persist in forks of the original project if a GitHub user is not careful.
