Claude Code 配置泄露数千密钥至 GitHub
安全公司 Apiiro 发现，Claude Code 的本地设置文件 .claude/settings.local.json 在用户选择“不再询问”批准命令时，会将含敏感信息的完整命令明文写入，导致数据库密码、API 令牌与 root 登录凭据随仓库公开泄露。尽管 Anthropic 文档称该文件默认加入全局 .gitignore，但实际防护存在缺口，数千条密钥已在 GitHub 上暴露。
报道正文
Claude Code is leaking sensitive information on public GitHub instances thanks to a partial oversight in the way its settings files are handled. That's the finding of AI security researchers at Apiiro, who discovered thousands of secrets, including database passwords, API tokens, and root logins, amid Claude Code settings files embedded in GitHub repositories.
The leak stems from the way Claude Code handles user approval for automated shell commands. When a user chooses the "Yes, and don't ask again" option to approve running a command, that choice gets stored as part of a rule in the local ".claude/settings.local.json" file on the user's computer. That rule is sometimes coded as a pattern, but the command itself is often written to that settings file as is, including any sensitive information that may be embedded within it.
This isn't really a significant security issue if the settings file stays on the user's local machine (assuming that machine doesn't become compromised itself, of course). And Anthropic notes in its Claude Code documentation that this particular settings file gets added to the developer's global .gitignore list, which usually prevents it from being shared publicly.