Apiiro analyzed more than 100,000 publicly discoverable copies of the file .claude/settings.local.json and found real credentials in 1,122 of them. The security company attributes the findings to the permanent approval of shell commands in Claude Code.
Affected are all those who use Claude Code in the terminal, in VS Code, in JetBrains IDEs or in the desktop app and store their code on GitHub, including web designers and freelancers who use it to build sites and scripts. The file is created on your own computer. Whether the file ends up in the repository determines the risk. Country and subscription play no role.
How does a password get into the configuration file?
If you confirm a shell command in Claude Code with "Yes, and don't ask again", the program saves the entire command as a permission rule in .claude/settings.local.json. If a password is in the command, for example after PGPASSWORD=, sshpass -p or mysql -p, the password then sits in plain text in the file.
Claude Code only protects the file against an accidental commit on your own computer. According to the documentation from Anthropic, the program adds the file to the global Git exclude list the first time it writes it, not to the project's .gitignore. If you create the file by hand, you add it to the .gitignore yourself.
What did Apiiro find?
The Apiiro analysis covers 104,185 copies of the file in 103,617 public repositories. In 1,122 of them, around 1.1 percent, a total of 1,379 secret credentials from 63 organizations were found, including 379 database passwords, 43 SSH accesses, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys.
Common scanners missed many hits: Gitleaks detected 564 of the 1,122 files, TruffleHog 643, and 215 went undetected by both. According to Apiiro, passwords after PGPASSWORD= have no typical key format and look like ordinary words to a search pattern.
Whether the credentials found are still valid was not checked. However, one affected company confirmed that an exposed key was still valid. Anthropic does not get a say in the reports on the analysis.
What this means for you
First check whether the file is in your repository. The command git ls-files .claude lists every file in the .claude folder that Git tracks. If settings.local.json is in the list and the repository is public on GitHub, assume that the stored credentials are known.
How to clean up your repository
Four steps, if the file .claude/settings.local.json is in the repository
- Checkgit ls-files .claude shows whether Git tracks the file
- ReplaceReplace credentials first, then clean up
- Removegit rm --cached takes the file out of version control
- ExcludeAdd the path to the project's .gitignore
Sources: Apiiro, Claude Code Docs
Replace the credentials before you clean up, because deleting the file cleans up neither the Git history nor forks. Afterwards, you remove the file from version control with git rm --cached .claude/settings.local.json and add this path to the project's .gitignore so that team members are protected as well.
In future, passwords do not belong in commands that you approve permanently. Instead, read passwords from environment variables or a tool for managing credentials, then the permission rule contains only the pattern, for example Bash(npm run test *) as in the documentation's example. The secret scanning of your Git provider adds protection, but overlooks passwords without a typical format.
Apiiro published the analysis in early November 2026.
Sources
