Application security research firm that discovered and disclosed the credential leak.
Security firm Apiiro found that Claude Code's local settings file .claude/settings.local.json writes full commands in plaintext when users approve them with 'don't ask again,' exposing database passwords, API tokens, and root credentials in public repositories. Although Anthropic's docs say the file is added to the global .gitignore by default, the safeguard has gaps, and thousands of secrets have already leaked on GitHub.
Security research firm Apiiro found that Claude Code's 'Yes, and don't ask again' option persists sensitive credentials from config files into saved commands, leaking 2,539 real secrets across 1,994 public GitHub repositories and affecting 63 organizations. Anthropic's Head of Claude Code Boris Cherny responded that the team is investigating mitigations, including auto-mode interception and built-in secret scanning.