Researchers found 1,122 public copies of Claude Code's settings.local.json holding a real secret

Apiiro published research on November 5, 2026 about .claude/settings.local.json, a project file that Claude Code writes. Claude Code's permissions docs say that when you choose "Yes, and don't ask again" for a Bash command, the approval is saved permanently for that repository and command, as a rule in .claude/settings.local.json at the root of the git repository. Apiiro says that when Claude Code proposes a command that carries a secret from your config, such as a database password, and you approve it this way, the exact command is saved, secret included.

What Apiiro found

Apiiro says it found 104,185 public copies of the file on GitHub, in 103,617 repositories, and that 1,122 of them (1.1%) hold a real secret. Together they hold 1,379 distinct secrets. Apiiro counts a value as a real secret when it matches a known provider key format or sits next to a public host, not when it is known to be valid, and it did not use or test any of them. Apiiro says more than a third open a database directly: 379 database passwords and 122 Supabase service-role keys. It counted another 103 Supabase account tokens, plus 43 SSH logins, 42 GitHub, GitLab and npm tokens, 23 AWS keys and 6 private keys. Counting older versions of the file in git history, the shared .claude/settings.json file and saved agent transcripts, Apiiro's total is 2,539 distinct secrets in 1,994 repositories.

Apiiro says every one of the 1,122 files sat on its repository's default branch on November 2, 2026, and that in 539 of the 1,105 repositories with a real secret it traced, a commit co-authored by Claude changed the file. It ran gitleaks and TruffleHog over all 104,185 files without verification: of the 1,122 files with a real secret, gitleaks flagged 564, TruffleHog flagged 643, and 215 were flagged by neither. Apiiro reported organization cases to their owners on November 2 and 3, and says one company confirmed its key had been live. It does not say whether anyone has used the secrets.

What Claude Code does to keep the file out of git

Claude Code's settings docs say that the first time it writes .claude/settings.local.json in a git repository that does not already ignore it, it adds **/.claude/settings.local.json to your global git excludes file, and that if you create the file by hand you should add it to .gitignore yourself. A global excludes file is a setting on your own computer, so it does not travel with the project, and ignoring a file does not untrack one that is already committed.

What to do

Apiiro's advice for developers:

1. If the file is tracked in a repo, untrack it with git rm --cached .claude/settings.local.json and add it to the repo's own .gitignore.
2. Rotate every credential the file has ever held. Removing it does not clear git history, forks or clones.
3. Even if the file was never committed, open it and delete every rule that contains a secret.
4. Stop typing secrets into commands. Refer to them as variables, such as $DB_URL, so the saved rule holds the variable name.
5. Approve patterns, such as Bash(npm run:*), instead of single literal commands.

Already pushed a key? See Keys committed to GitHub for what to do next.

Our advice, not Apiiro's: if the file held a Supabase service-role key or a Supabase account token, treat it as a full compromise of that project or account. Rotate the key, or revoke the account token, in the Supabase dashboard, then check your tables and storage for changes you did not make. Apiiro also notes the file can leave your machine without git, inside a published npm package, a Docker image built with a copy command, a zip archive or a synced folder, so check those too.