Claude Code Settings Leak: 5,343 Valid Secrets on GitHub

November 9, 2026. Claude Code's "Yes, and don't ask again" button can save an API key or database password into .claude/settings.local.json, and that file keeps reaching public GitHub. Security firm GitGuardian published research today counting 31,088 distinct secrets in the file on public GitHub between January 2025 and November 7, 2026, across 23,276 repositories, with 5,343 of them working when detected. If your team uses Claude Code, the fix starts with rotating whatever that file ever held.

What GitGuardian and Apiiro found

1. 31,088 secrets, 5,343 valid. GitGuardian's report says its automatic read-only check found 5,343 of the 31,088 distinct secrets valid at detection, about 17%. It calls these floors, because detectors without a checker are never counted as valid.
2. Databases and SSH are the live ones. The file held 1,955 distinct valid Postgres connection strings, 292 valid SSH passwords and 941 valid Google API keys. curl commands account for half the volume, but GitGuardian says the valid credentials were mostly database and SSH logins.
3. Docker Hub copies too. 613 secrets reached public Docker Hub images, 99 of them valid, and one valid Cloudflare API token appeared in 559 image tags. A COPY . . instruction ships the working tree, so a file git ignores still ends up in the image unless .dockerignore lists .claude/.
4. The inflow peaked in April 2026. Monthly leaks in the file rose from 256 occurrences in June 2025 to 12,535 in April 2026, then fell to 959 in October 2026, a 92% drop. GitGuardian says it does not yet know what changed.
5. Apiiro also counted leaks. Apiiro's analysis, published November 5 and reported by iTnews, found 1,379 distinct secrets in current copies of the file and 2,539 once older versions and related files were added. Apiiro did not test whether they worked. Of the 1,122 copies with a secret, 215 slipped past both gitleaks and TruffleHog.

Why "don't ask again" saves the key

Claude Code asks before it runs most shell commands. Anthropic's permissions documentation says that when you choose "Yes, and don't ask again" for a Bash command, Claude Code saves the rule to .claude/settings.local.json at the root of the git repository. GitGuardian and Apiiro found that when the approved rule is the exact command, any key typed into that command is saved with it, in plain text.

Anthropic's settings documentation says Claude Code keeps that file out of git when it creates it, and that if you create it by hand you should add it to .gitignore yourself. GitGuardian's point is that the protection lives on your machine, not in the repository, so another machine, an older clone or a file that was already tracked can still be committed.

The shared project file, .claude/settings.json, leaks for a different reason. GitGuardian counted 8,271 distinct secrets there, and a quarter of the leaking versions pointed Claude Code at a third-party gateway with a token in an env block. It also found 6,155 distinct secrets in CLAUDE.md files, 2,537 of them valid.

What Anthropic has said

Boris Cherny, head of Claude Code at Anthropic, replied on Hacker News, as quoted by iTnews: "Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this." He said the team would prototype ways for auto mode to catch such commands and basic secret scanning, which might not fix it. He also argued the exposed copies were created by hand and committed, and recommended auto mode over permission rules plus the secret scanning that code hosts offer. Users had reported the problem in GitHub issues since August 2025, iTnews notes. We could not confirm whether Anthropic has shipped a change since.

How to check and fix your repositories

1. Search for the file. In every repository, check whether .claude/settings.local.json is tracked or appears in history, forks or container images.
2. Rotate first. GitGuardian and Apiiro both say to rotate every credential the file ever held before cleaning up, because history, forks and images keep copies. Deleting the file does nothing for images already pushed.
3. Ignore it in the repo. Add .claude/settings.local.json to the repository's own .gitignore, and .claude/ to .dockerignore.
4. Clean the rules. Open the file, or run /permissions, and delete every rule that contains a secret.
5. Use variables, not values. Reference keys as environment variables such as $N8N_API_KEY, so the saved rule records the name. Approve a narrow prefix rather than a blanket rule like Bash(curl:*), which GitGuardian notes would approve any curl, including one written by a prompt injection.
6. Scan the agent folders. Treat .claude/, .cursor/, .gemini/, .codex/, .mcp.json and CLAUDE.md like .env files, and use a scanner that catches passwords inside commands: GitGuardian says generic detectors produced 63% of what it found in settings.local.json.

GitGuardian sells AI Hooks for ggshield, which scan commands before Claude Code runs them, so read its tooling advice with that in mind. The steps above do not need any paid product.

What it means for small teams

Small agencies and in-house teams often paste n8n, Supabase or database keys straight into an agent prompt to get a workflow running, which is the pattern behind many of these leaks. If a contractor or an AI agent touches your repositories, ask whether these files are ignored, scanned and free of live keys. Short-lived credentials help too: our earlier note on Anthropic workload identity federation covers one way to avoid static API keys, and our Claude Code pricing guide covers plans.

If you hire an AI automation agency or any outside developer, ask where API keys will live and whether agent folders are scanned before anything is pushed. The same question applies to vendors doing AI search optimization work that needs access to your site's repository.