Claude Code approval file saves typed passwords and keys; 1,122 public GitHub copies hold secrets (no CVE)
Severity: high · Patch status: unknown · Since 2026-11-05
Apiiro, an application and agent-security vendor, published research on 5 November 2026 showing that Claude Code's 'don't ask again' approval stores each approved shell command verbatim in .claude/settings.local.json, including any password or key typed into it. Claude Code adds that file to the developer's global git excludes but not to the project .gitignore, so it can be committed and pushed. Apiiro's public GitHub search (data collected 1-3 November 2026) found 104,185 copies of the file. Of these, 1,122 (about 1.1 percent) were classified as containing secrets, holding 1,379 distinct values. In a wider investigation that also covered git history, shared settings and agent transcripts, Apiiro counted 2,539 secrets across 1,994 repositories. Apiiro did not test whether the credentials still work. One notified company confirmed that its exposed key was live. No Anthropic statement or confirmation appears in the coverage found, and the figures come from a single vendor study with no independent replication, so treat the scale as a reported claim rather than a measured breach. The fix is rotation of every credential the files have held, removing the file from git and from the project, using variables instead of literal secrets in approved commands, and adding agent folders to secret scanning.
What to do
- Search your GitHub organization and git histories (including forks and deleted files) for .claude/settings.local.json and .claude/settings.json
- Rotate every password, token, and key those files have ever held before cleaning up; prioritize credentials paired with public servers
- Stop tracking the local file (git rm --cached) and add it to the repository's own .gitignore
- Delete rules containing secrets from local copies of the file, even if never committed
- Use secrets-manager variables (e.g. $DB_URL) instead of literal secrets in commands, and approve patterns like Bash(npm run:*) rather than exact commands
- Add agent folders (.claude/, .cursor/, .gemini/, .specstory/) to pre-commit and CI secret scanning, including git history, with scanners that catch passwords inside commands
Sources
All live incidents on Threat Watch
