Claude Code's settings.local.json Is Leaking Secrets

§ 01How a password ends up in a settings file#

Ask Claude Code to check why a staging login fails or to run a migration, and the command it proposes carries the password from your config, because it cannot work without it. Claude Code asks before running a shell command. If you pick “Yes, and don’t ask again”, it runs the command and writes an allow rule into .claude/settings.local.json so it will not ask next time. The rule is the command string itself, secret included.

Claude Code’s settings documentation describes the guard: the first time it writes the file in a git repository, “it adds **/.claude/settings.local.json to your global git excludes file, so the file stays out of your commits in every repository.” That guard lives in one person’s git settings on one machine. In Apiiro’s words, “The rule never goes into the repo’s own .gitignore, so nothing travels with the project to protect it.” A folder that becomes a repository later, a clone on another computer, or a file already committed are all outside it.

Often the agent commits the file itself. In 539 of the 1,105 repositories with a real secret that Apiiro traced, a commit co-authored by Claude changed the file. Apiiro reproduced the behavior with Opus 5.5 and Fable 5.1 and puts it plainly: “This is Claude Code’s own behavior, not the model’s“.

§ 02What Apiiro found#

More than a third of the secrets open a database directly. Apiiro counted 63 affected organizations, mostly software companies, and the strongest cases include a database vendor’s own admin-level cloud key and the owner password of a medical-records database. It reported each case to its owner on November 2 and 3, and one company confirmed its key had been live. Apiiro did not test any credential: “No credential was used or tested, and no host was contacted.”

The files are not fresh mistakes. Every one sat on its repository’s default branch on November 2, and in the median repository the file had been there 217 days. Bigger files leak more: one in ten files over 8 KB holds a real secret, against fewer than one in 500 under 500 bytes, because each click adds another approved command.

§ 03What secret scanners miss#

Apiiro ran gitleaks and TruffleHog over all 104,185 files. Of the 1,122 with a real secret, gitleaks flagged 564 and TruffleHog 643, and 215 were flagged by neither. The misses are mostly passwords typed inside commands, after PGPASSWORD=, sshpass -p or mysql -p, which look like ordinary words to a scanner tuned for key formats. A copy that never reaches GitHub still sits in plain text on the laptop, where credential-stealing malware such as the Shai-Hulud npm worm has already run TruffleHog over victims’ files.

§ 04It is not one file#

The pattern spreads wherever an agent records what it ran. On Hugging Face, 126 of 31,053 Spaces hold the same local settings file. Of 16 coding agents whose documentation Apiiro compared, Claude Code is the only one confirmed to write the full approved command to a project file by default. As Apiiro sums it up: “The habit that leaks is the same everywhere: typing a secret into a command that an agent then records.”

§ 05What Anthropic has said#

Nothing public yet, as of November 7, 2026, 11:50 UTC. Users have reported the mechanism in GitHub issues since August 2025 (#5544, #11982, #13106, #91270), and Apiiro says “None got a reply from Anthropic”, with three closed automatically as inactive or duplicate. This follows our record of Claude Code sending users’ emails to websites the same week: another case where a default inside the harness, not the model, decides what leaves your machine.

§ 06What to do today#

• Rotate first. Change every password, token and key the file has ever held. Deleting it does not clear git history, forks or clones.
• Untrack it. Run git rm –cached .claude/settings.local.json and add the file to the repository’s own .gitignore, so the rule travels with the project.
• Read your local copy. Even if it was never committed, open the file and delete every allow rule that contains a secret.
• Keep secrets out of commands. Reference them as variables, so the saved rule records $DB_URL and not the password.
• Approve patterns, not literal commands, such as Bash(npm run:*).
• For security teams: treat agent folders (.claude/, .cursor/, .gemini/, .specstory/) like .env files, and make sure CI and pre-commit scanning catch passwords inside commands, not only provider key formats.

§ 07Where CellCog sits#

Our conflict, declared: CellCog’s agents run on Anthropic’s Claude Opus 5.5, and we use Claude Code to build parts of our product, so this is our problem as much as anyone’s. On CellCog, keys an owner adds on the Keys page reach an AI employee’s scripts as environment variables, which is the habit Apiiro recommends: the command references the variable and the value never appears in it. For the wider principle, see least privilege for AI agents, and for what an agent loose on the internet does with a guessable key, the WorkOS breach.

§ 08What we are watching#

• Anthropic’s response. A Claude Code release that stops saving literal secrets, or that writes the file into the repository’s own .gitignore.
• Rotation. Whether the 63 organizations rotate and whether GitHub’s own secret scanning starts catching passwords inside commands.
• Other agents. Whether Cursor, Gemini CLI or Copilot change how they store approvals.

§ 09Sources#

• Apiiro: Coding Agents Copy Your Secrets to a Hidden File. Thousands Are on GitHub, Shmulik Cohen and Matan Giladi, November 5, 2026, read November 7.
• Claude Code documentation: Settings, read November 7, 2026.
• The Hacker News: Claude Code’s “Don’t Ask Again” file exposes passwords and keys, Swati Khandelwal, November 7, 2026.
• GBHackers: Claude Code’s “Don’t Ask Again” feature exposes 2,539 secrets, November 7, 2026.