Claude Code settings files expose thousands of secrets on GitHub
Ars Technica AI · rss · 2026-11-10
AI security researchers at Apiiro found that Claude Code settings files are leaking thousands of secrets — database passwords, API tokens, root logins — into public GitHub repos. The cause: when users approve a shell command with "Yes, and don't ask again," the approval and the command text (including embedded credentials) get written to the local .claude/settings.local.json. Anthropic's docs say the file is added to the global .gitignore, but that protection doesn't always hold. Developers using Claude Code should audit their settings files for embedded secrets.
More from coding & agent
- OpenClaw ships v2026.11.2 patch: 113 PRs fix broken updates, missing reminders, duplicate widgets — dean_rie · 2026-11-10
- Hooking a cloud AI agent to your home network: Muse + Tailscale + MCP drives RC cars via SDR — Dave_Maynor · 2026-11-10
- Claude Duet Connects to Claude Code on Your Mac: Code, Edit Video From Your Phone — dean_rie · 2026-11-10
- OpenRouter's MCP gets a major upgrade: try all models in any agent before writing code — dean_rie · 2026-11-10
- Patch launches: every game dev tool in one CLI and MCP for coding agents — noahsolomon · 2026-11-10
- Open Artifacts: open-source home for AI agent artifacts with MCP publishing — dean_rie · 2026-11-10