Claude Code Files Leak Secrets

United StatesOver 100,000 Claude Code settings files sit on public GitHub.

About 1,100, from 63 organizations, held passwords, access tokens or private keys, security firm Apiiro found.

Choosing the don’t-ask-again option writes the approved command, secrets included, into a settings file that can reach GitHub.

Claude Code’s Boris Cherny said the files should almost never be checked in.

Cherny’s team is weighing built-in secret scanning, though gitleaks and TruffleHog missed 215 of the secrets.

How each outlet framed it

Ars Technica leans critical: traces the leak to Claude Code storing 'don't ask again' approvals verbatim in .claude/settings.local.json, which the repo-level gitignore misses