Claude Code secrets: Claude Code Secret Exposure: How Approval Rules Can Reach

By TechnoRapper editorial desk. This is an attributed analysis of the linked source, not original reporting or an independent test.

Claude Code secrets — Claude Code secret exposure happens when a command approval rule containing sensitive text is copied into a settings file that later appears in a public GitHub repository. AI security researchers

What changed

Claude Code secret exposure has drawn attention to a gap between local command approvals and the files developers may share. According to Ars Technica’s report, Apiiro researchers found thousands of secrets embedded in Claude Code settings files across public GitHub repositories.

The reported credentials include database passwords, API tokens, and root logins. The files at issue are named .claude/settings.local.json, and the report links their contents to how Claude Code remembers permission for automated shell commands.

When a user selects “Yes, and don’t ask again” for a command, Claude Code stores that approval as a rule in the local settings file. Sometimes the rule is represented as a pattern, but the command itself may instead be written as entered, carrying along sensitive information included in the command.

That distinction matters when developers place credentials directly in a command. A remembered approval can then preserve that text in a file, rather than only retaining a generalized rule that omits the secret.

Why it matters

A settings file on a developer’s own computer does not automatically create a public exposure. As Ars Technica explains, the risk appears when that file leaves the local machine and becomes part of a public repository; keeping it local limits the exposure, unless the machine itself is compromised.

Anthropic’s Claude Code documentation, as described in the report, says the settings file is added to the developer’s global .gitignore list. That exclusion is meant to keep the file out of version control, but the researchers’ discovery shows that sensitive settings files have nevertheless appeared in public GitHub repositories.

For developers using AI coding tools, the episode highlights a practical security boundary: convenience features can save command approvals, while the saved data may contain more than a permission choice. The concern is not simply that an AI tool runs shell commands; it is that command text containing credentials may persist in a file that developers could share.

This is also relevant to teams that rely on repositories to share code. A credential exposed in a public repository can create a risk for the systems and services that credential reaches, although the supplied report does not identify specific affected organizations or confirm how any individual secret was used.

Who is affected

Claude Code users are the most direct audience for the finding, particularly developers who approve shell commands using the option to stop future prompts. The exposure described by Apiiro concerns settings files that were present in public GitHub repositories, not every Claude Code installation.

Teams whose developers use shared repositories may also need to consider whether local settings files or command text have been committed. The report does not name particular companies, repositories, or victims, so it does not establish which organizations were affected.

People responsible for credentials should pay attention if secrets have been entered directly into shell commands and those commands were approved for repeated use. However, the source does not say that every stored command contains a secret, or that every discovered credential remains valid.

What to watch next

The immediate question is whether affected developers or organizations identify and remove exposed settings files and address any credentials they find in them. The source establishes that Apiiro found thousands of secrets, but it does not provide a response plan, remediation totals, or details about whether the discovered credentials were revoked.

Developers can also watch for further clarification about how the settings file is excluded from repositories and what circumstances may allow it to appear publicly. The report describes the global .gitignore safeguard but does not explain why individual files escaped that protection.

For now, the practical lesson supported by the report is to treat remembered command approvals as potentially sensitive when commands contain credentials. The next meaningful developments would be information about the scope of the exposed files and how Claude Code users should handle secrets already stored or published.

Frequently asked questions

What caused the Claude Code GitHub exposure?
Claude Code can save an approved shell command as a rule in .claude/settings.local.json when a user chooses “Yes, and don’t ask again.” If the command contains sensitive text and the settings file appears in a public repository, that text may be exposed.

What kinds of secrets did researchers find?
Apiiro researchers found thousands of secrets in Claude Code settings files on public GitHub repositories. Ars Technica lists database passwords, API tokens, and root logins among them.

Is the Claude Code settings file supposed to be public?
No. The report says Anthropic’s documentation describes the local settings file as part of the developer’s global .gitignore list, which usually prevents it from being shared publicly. The researchers’ findings show that settings files have still appeared in public repositories.

Source note: The TechnoRapper editorial desk used Ars Technica’s supplied report as the factual basis for this article; the report attributes the discovery to AI security researchers at Apiiro.

Related on TechnoRapper

• how to distinguish reported AI-security claims from what they establish
• another look at how AI is changing work
• Golden Dome funding: What a Democratic Congress could change

Source: Ars Technica

How we used the source: facts, quotes, and numbers below come only from that link. We added structure, search intent, and reader context. We did not independently verify the reporting.