Apiiro Found 1,122 Public Copies of Claude Code's Settings File Holding Secrets. Search Your Own Repos for .claude/settings.local.json Today, and Rotate Before You Delete.
If your team uses Claude Code, search your GitHub organization today for a file called .claude/settings.local.json, and rotate any secret you find in it before you clean anything up. Apiiro reports that 1,122 public copies of that file hold at least one secret, and The Hacker News published the findings on November 7, 2026. We use Claude Code too, so this one is about our own tooling as much as yours.
What is reported
When a user answers "Yes, and don't ask again" at a command approval prompt, Claude Code saves an allow rule. If the rule is for one exact command, anything typed into that command is saved word for word in the project's .claude/settings.local.json, including a password or token. Apiiro says Claude Code adds the file to the user's global git excludes but not to the project's own .gitignore, so the protection does not travel with the project.
Apiiro counted 104,185 copies of the file in 103,617 public repositories. Of those, 1,122 copies (about 1.1 percent) contain at least one secret, 1,379 secrets in all. More than a third open a database directly, including 379 database passwords. Others are 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. The owners include 63 organizations. In 539 of the 1,105 repositories Apiiro traced, a commit listing Claude as co-author changed the file, which the researchers read as Claude often committing it itself.
What is not solid
- Nobody tested the secrets. Apiiro did not check whether they still work. One notified company confirmed its key was live.
- What counts as a secret is a judgment. A value counted if it matched a known key format, or if a password or token sat beside a public server address, and an AI reviewer had to agree. Two common scanners disagreed: Gitleaks flagged 564 of the 1,122 files and TruffleHog 643, and neither flagged 215.
- The wider totals are a different count. Including older file versions, a second shared settings file and saved agent chat logs, Apiiro reports 2,539 secrets across 1,994 repositories. Do not add that to the 1,122.
- The comparison to other tools is Apiiro's. It says Claude Code is the only one of 16 coding agents it compared that saves the full approved command in a project file by default. We did not test any of them.
- Anthropic's side is thin. The article reports no fix or statement. It says an August 2025 bug report was closed as "not planned" by an automated bot after 60 days of inactivity, and four related reports were closed the same way. We did not read those reports.
What our own edge saw
We did not find this, and we have no lead on Apiiro. But scanners already look for these paths. Checking our edge since October 8, we found 8 blocked requests from 4 addresses for /.claude/settings.json or /.claude/settings.local.json, the first on October 18 and the last on October 30. Our decoy responses answered 2 more, from 1 address, on October 30. Our origin honeypot saw none, which fits the edge doing its job. That is 10 requests in a month. It shows these file names are in scanners' path lists. It does not show that anyone read a secret from us, because we host no such file.
What to do this week
- Search your GitHub organization for both .claude/settings.local.json and .claude/settings.json, including git history.
- Rotate every password, token and key those files have held before cleaning up. Deleting the file does not remove it from history or from forks.
- Run git rm --cached .claude/settings.local.json and add the file to the repository's .gitignore. Delete any rule that contains a secret from local copies too, even uncommitted ones.
- Approve command patterns, for example Bash(npm run:*), rather than single commands, and pass secrets as variables from a secrets manager instead of typing them into commands.
- Treat .claude/, .cursor/, .gemini/ and .specstory/ like .env files: add secret scanning to pre-commit and CI, including history, and make sure it catches passwords inside commands.
- Check credentials paired with public server addresses first. They give direct access.
These steps follow the article's recommendations. The ordering, rotate first, is our emphasis.
Indicators
None. This is a misconfiguration pattern, not an actor, so there is nothing to add to the feed.
Limits
We read The Hacker News write-up of Apiiro's research. We did not read Apiiro's own report, test the behavior, or scan any repository. Every count is Apiiro's as reported. Our edge figures come from our own block and decoy logs since October 8 and cover paths scanned, not data taken.
Five percent of this is wrong somewhere. It always is. Apiiro's report will correct a count or a detail about which file versions are affected.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.