Claude Code Settings Files May Expose Secrets on Public GitHub Repositories

Claude Code is leaking sensitive information on public GitHub instances due to an oversight in how its settings files are handled, according to AI security researchers at Apiiro. The researchers found thousands of exposed secrets, including database passwords, API tokens, and root credentials, in Claude Code settings files uploaded to public GitHub repositories.

The issue appears to stem from the way Claude Code handles user approval for automated shell commands. When a user selects “Yes, and don’t ask again” to approve a command, that approval can be stored as a rule in the local .claude/settings.local.json file. The rule may be coded as a pattern, but the command itself can be written to the settings file as provided, potentially including sensitive information.

This may not be a serious security issue if the settings file remains on the user’s local machine, assuming that machine is not itself compromised. Anthropic notes in its Claude Code documentation that this particular settings file is added to the developer’s global .gitignore list, which usually prevents it from being shared publicly.

Apiiro’s researchers found more than 100,000 cases in which the local Claude Code settings file had been uploaded to a public GitHub repository. About 1,100 of these, from 63 different organizations, contained secrets such as API tokens, database passwords, or private keys. Even after such files are removed from a repository, the secrets can persist in forks if a GitHub user is not careful.

Source link