AI coding tool's saved approvals are leaking passwords onto GitHub

When an AI coding tool asks permission to run a command and you tick "don't ask again," it can save the whole command. If that command contains a password, the password is saved too. Security firm Apiiro says it found over a thousand such files sitting in public repositories on GitHub.

What the researchers found

Apiiro researchers Shmulik Cohen and Matan Giladi published their work on 5 November. They say Claude Code can keep a full approved command, credentials included, in a file called .claude/settings.local.json. If that file is pushed to a public repository, the credentials go with it.

• They checked 104,185 public copies of the file and flagged 1,122, about 1.1%, as holding secrets.
• Those files held 1,379 distinct values.
• A wider search counted 2,539 distinct secrets across 1,994 repositories.

What is not known

Apiiro did not test the credentials. It spotted likely ones by their format and context, so it is unclear whether any still work. The findings show a risk of exposure, not a proven breach. Apiiro also sells security products, so the totals are its own findings. It says one company confirmed an exposed key had been live.

Why it happens

Anthropic says the file is meant for personal settings, and Claude Code adds it to the developer's global Git exclude list. Git is the system that tracks code changes. But that list lives on one person's machine, not in the project. Git also ignores such rules for files it already tracks. A filename with "local" in it does not keep the file private.

This is not a trick that makes an AI steal a password. It happens during normal, approved work. A report about the same behavior was opened in August 2025 and closed automatically in January 2026 after inactivity, which does not show a fix.

What to do

• Change or revoke any exposed password or key first, as GitHub advises.
• Check the local settings file, shared agent settings and saved transcripts for secrets.
• Stop tracking personal settings and add them to the project's own .gitignore.
• Use a secret manager instead of typing passwords into commands.

Deleting the file does not remove older copies, forks or other people's clones. Cleaning up history takes care, but it should not delay disabling the password.