- Security firm Apiiro found 2,539 real secrets across 1,994 public GitHub repositories, including database passwords, cloud keys, API tokens, and SSH root logins.
- Choosing “Yes, and don’t ask again” in Claude Code saves the approved command, secret included, to
.claude/settings.local.json, a file nothing marks as private. - Of 104,185 public copies of that file found on GitHub, 1,122 contain a real secret; 1,160 more turned up in git history and shared settings files.
- Apiiro says it reproduced the same behavior with Opus 5.5 and Fable 5.1, calling it a property of Claude Code‘s own workflow rather than any one model.
What Happened
Security research firm Apiiro published findings on November 5, 2026 showing that Claude Code‘s permission system has leaked thousands of real secrets onto public GitHub. When Claude Code proposes a shell command that needs a local secret, such as a database password, picking “don’t ask again” writes that exact command, secret and all, into a project settings file.
Why It Matters
Nothing about .claude/settings.local.json flags it as sensitive, so it gets committed alongside ordinary code. The research lands weeks after a separate incident in which a contractor’s personal Claude Code agent ran inside a Pentagon network for two months, underscoring how agent permission settings can carry real operational risk.
Technical Details
Apiiro’s scan covers 1,994 public repositories tied to 63 organizations, from student groups to established software vendors. Confirmed exposures include a database vendor’s own admin-level cloud key, a production Azure Postgres password, a Square production token, and the owner password of a medical-records database; one affected organization confirmed its key had been live.
Who’s Affected
Apiiro says the behavior is not specific to any one model and reproduced with Anthropic’s Opus 5.5 and Fable 5.1, meaning any team using Claude Code’s permission-approval flow with “don’t ask again” on a command that embeds a secret is exposed. Individual developers account for most of the affected repositories.
What’s Next
Apiiro’s advisory tells teams to search their GitHub organizations for .claude/settings.local.json and settings.json, check git history even for deleted copies, and rotate any exposed credential before cleaning up the file.
