Claude Code .claude/settings.local.json Commits 1,379 Secrets to 1,122 Public GitHub Repos

Apiiro researchers scanned GitHub and located 104,185 instances of the settings file across 103,617 repositories. Of these, 1,122 held at least one secret matching known key formats or paired with server addresses; 379 were database passwords, 43 SSH credentials, 42 GitHub/GitLab/npm tokens, and 23 AWS keys. In 539 repositories the file was introduced by a commit listing Claude as co-author, indicating the agent itself wrote the secret into version control despite the global exclude mechanism.

The protection Anthropic documented relies on a per-user global git exclude that never travels with the project and never populates the repository .gitignore. Once committed, the file and its history persist in forks and default branches; 211 forks of 74 repositories still carry the same secrets. Older versions add another 734 secrets across 509 repositories, pushing the total exposed set to 2,539 when shared settings.json and chat logs are included.

This pattern reveals a systemic gap in AI coding agents: only Claude Code was confirmed to persist the verbatim approved command. The design assumes a single-developer workflow and ignores the reality of shared repositories and long-lived git history. Organizations listed among the 63 affected owners include database vendors and medical-records platforms, indicating the exposure reaches production infrastructure rather than only test environments.

Remediation requires immediate rotation of every credential that ever appeared in the file, followed by history rewrite or repository deletion. Future agent designs must either redact secrets before storage or enforce project-level .gitignore entries that propagate with the codebase.