Claude Code is leaking sensitive information on public GitHub instances due to a partial oversight in how its settings files are handled, according to AI security researchers at Apiiro. The leak stems from the way Claude Code handles user approval for automated shell commands. When a user selects the "Yes, and don't ask again" option, that choice gets stored as part of a rule in the local ".claude/settings.local.json" file.
That rule may be coded as a pattern, but the command itself is often written to that settings file as-is, including any sensitive information embedded within it. While the settings file typically stays on the user's local machine, the .gitignore setting preventing its public sharing is not reflected at the repo level. This allows the sensitive file to be uploaded accidentally if a repo is cloned to another machine or a folder becomes a repo later.
Furthermore, Claude Code itself will commit changes to the settings file without user input. Apiiro's researchers found over 100,000 cases where Claude Code's local settings file had been uploaded to a public GitHub repository. Of these, approximately 1,100 from 63 different organizations contained secrets such as public API tokens, database passwords, or private keys.
Even after removal from a repository, the secrets can persist in forks of the original project if a GitHub user is not careful.
Source: Ars Technica · Summarized by HeadlinesBriefing