Claude Code approval settings expose thousands of credentials
Security researchers have identified 2,539 distinct credentials and other secrets across 1,994 public GitHub repositories, linking the exposures to configuration files and saved records generated during AI-assisted software development. Application security company Apiiro disclosed the findings on 5 November after examining publicly accessible repositories. Its investigation identified a…
A security investigation has uncovered over 2,500 distinct credentials and secrets stored in publicly accessible GitHub repositories, linked to the use of Anthropic’s Claude Code AI-assisted software development tool. Apiiro, an application security company, discovered the issue after analyzing public repositories. The primary risk identified was that approving a shell command with the option "Yes, and don’t ask again" can persist sensitive data, including passwords or access tokens, in a local settings file named .claude/settings.local.json.
This file stores permission rules to prevent developers from repeatedly approving prompts. When a command includes credentials, the saved rule may retain those credentials in readable form. Researchers found 104,185 copies of the local settings file across 103,617 repositories, with approximately 1,122 files (about 1.1 percent) containing secrets.
The exposed secrets included 379 database passwords, 122 Supabase service-role keys, 103 Supabase account tokens, 43 SSH login credentials, 42 tokens from GitHub, GitLab, and npm, 23 Amazon Web Services keys, and six private keys. These credentials could grant varying levels of access depending on their permissions and validity.
Apiiro identified 63 organizations as owners of affected repositories, mostly software businesses. One example cited was an administrative cloud credential from a database provider, a production PostgreSQL password from Microsoft Azure, and a database owner password linked to medical records. The exposed credentials were not necessarily active or exploited.
However, researchers confirmed that an exposed key was still active in one organization. Additionally, the researchers found 734 more secrets in earlier versions of files across 509 repositories. Removing a password from the latest file version does not automatically erase it from the Git history, which can complicate containing the exposure.
The investigation also found 211 forks of 74 repositories containing the same secrets. Anthropic’s documentation indicates that Claude Code writes command approvals into the local settings file, which is supposed to be excluded from Git commits by default. However, without a shared Gitignore file, repositories can be vulnerable if files are tracked through another environment or deliberately added to version control.
The investigation reviewed commit records for 1,105 affected repositories and found 539 instances where changes to the settings file appeared in commits crediting Claude as a co-author. This suggests that AI-assisted commit workflows contributed to the exposure. Apiiro also tested established secret-scanning tools, Gitleaks and TruffleHog, which found 564 and 643 of the 1,122 secret-bearing local settings files, respectively.
However, 215 files escaped detection. To mitigate the exposure, security teams need to revoke or rotate affected passwords and tokens, review Git history, check for forks, and apply repository-level exclusion rules. Some exposed files had remained publicly accessible for months, indicating that exposure is not limited to specially configured repositories.
Careful review of shared Claude Code settings files and their permission rules is especially important.
Written by urgent.news from Arabian Post's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
