Claude Code Approvals Leak Secrets to GitHub: What to Check

Security firm Apiiro reported on November 5, 2026 that Claude Code, Anthropic's coding agent, writes commands a user approves permanently into a project file, including any password typed into them. On GitHub it found 1,122 such public files holding real secrets. It matters to anyone who builds a website, or has one built, with this agent.

What we know

  • How it happens: according to Apiiro, when Claude Code proposes a command that needs a credential (querying a database, calling an API) and the user picks "Yes, and don't ask again", the command is saved verbatim, secret included, as a permission rule in `.claude/settings.local.json` inside the project folder. Claude Code's documentation confirms that this choice saves the approval to that file as an `allow` rule.
  • Why it reaches GitHub: the documentation says that the first time Claude Code writes the file in a git repository it adds it to the user's global git excludes, and that a file created by hand must be added to `.gitignore` manually. Apiiro notes that the exclusion stays on the developer's machine: it does not travel with the project and does not cover a folder that later becomes a repository, a clone on another machine or a file already committed.
  • How many: between November 1 and 3, 2026, Apiiro counted 104,185 public copies of the file in 103,617 repositories. 1,122 of them (1.1%) hold at least one real secret, 1,379 distinct secrets in total.
  • What kind: more than a third open a database directly: 379 database passwords and 122 Supabase service-role keys. The report also lists 43 SSH logins for public servers, 42 GitHub, GitLab and npm tokens, and 23 AWS keys.
  • Beyond that file: adding older versions, the shared settings file and saved agent conversations, Apiiro counts 2,539 secrets in 1,994 repositories. Older versions alone hold 734 secrets in 509 repositories that no longer appear in the current copy, so deleting the file does not remove them from history.
  • Who: 63 organizations, mostly software companies. Apiiro notified them on November 2 and 3, and one confirmed its key had been live. Apiiro does not say whether the others still work.
  • Scanners miss some: per Apiiro, one in five files with a secret is flagged by neither gitleaks nor TruffleHog, because the secret is a password typed into a command rather than a key in a known format.
  • Anthropic: Apiiro says users have reported the behavior on GitHub since August 2025 and none of those reports got a reply. The Hacker News reports no statement from Anthropic.

What changes and what doesn't

  • It is not a model bug: Apiiro says it is how the tool behaves and that it reproduced it with the latest models. Of 16 coding agents compared through their documentation, Claude Code is the only one confirmed to write the full approved command to a project file by default.
  • No attack is needed for exposure: the secret is exposed as soon as the file is public. Apiiro's count covers public files; it does not measure how many were used.
  • GitHub is not the only exit: the report notes the file can also ship inside a published package, a Docker image, a zip file or a synced folder, and that on the developer's machine it sits in plain text.
  • The habit is what changes: typing a password into a command an agent approves keeps that password on file until someone deletes the rule.

How to tell if you're affected

If you build your site with Claude Code (or another agent):

  1. Search your repositories for `.claude/settings.local.json` and `.claude/settings.json`. In a public repository, anyone can read them.
  2. Check history even if the file is gone: `git log --all -- .claude/settings.local.json`. If it shows up, the secret lives on in history, forks and clones.
  3. Open the file on your machine and read the `allow` list for passwords, tokens, database connection strings or SSH logins.
  4. If you find one, rotate the credential first (database, hosting, API), then clean up. Apiiro stresses that order.
  5. Untrack the file with `git rm --cached .claude/settings.local.json` and add it to the project's own `.gitignore`, not just your machine's.
  6. Going forward, have commands reference variables (`$DB_URL`) and approve patterns such as `Bash(npm run:*)` instead of commands with the secret written in.

One more check, on your server: if you upload the whole project folder by FTP or as a zip, the `.claude/` folder may have gone with it. Open `https://yourdomain.com/.claude/settings.local.json` in a browser: it should return a 403 or 404 error. Not every server blocks dot-folders by default. If the file downloads, delete it from the server and rotate whatever it contains.

If a developer or agency builds your site, ask them:

  1. "Do you use Claude Code or another AI agent on my project?"
  2. "Is `.claude/settings.local.json` in the repository's `.gitignore` and kept off the server?"
  3. "Has any password for my database, hosting or APIs ever been written into those files? If so, has it been changed?"

Related: OpenCode Breach Put AI API Keys at Risk: What to Do

Sources

Updates: if Anthropic changes how approvals are stored or responds to the report, it will be added here with a link.