What changed
AI security researchers at Apiiro discovered that Claude Code settings files, which store user approvals for automated shell commands, were being uploaded to public GitHub repositories. These files often contain sensitive information such as database passwords, API tokens, and root logins. The issue stems from how Claude Code handles user approvals, storing them in a local settings file that can be inadvertently shared.
What this means in practice
The leak occurs when the local .claude/settings.local.json file, which stores user approvals, is committed to a GitHub repository without proper protection. While the file is typically added to the developer’s global .gitignore list, this setting isn’t reflected at the repo level, allowing accidental uploads. Apiiro’s researchers found over 100,000 cases of such uploads, with about 1,100 containing sensitive secrets. Even after removal, these secrets can persist in forks of the repository if not carefully managed.
Limitations and availability
Claude Code’s documentation notes that the settings file should not be checked into version control, but the issue persists due to manual uploads or unintended commits. The problem was flagged in a bug report as early as August 2025, but no action was taken. Anthropic’s Boris Cherny acknowledged the issue and recommended using auto mode to reduce manual configuration. However, sensitive commands can still be saved in settings files, and some secrets were not flagged by popular secret scanners like gitleaks and TruffleHog.
