Claude Code settings files expose thousands of secrets on public GitHub
AIAI security researchers at Apiiro found thousands of secrets, including database passwords, API tokens, and root logins, in Claude Code settings files embedded in public GitHub repositories. The leak occurs when a user chooses "Yes, and don't ask again" for a shell command, which Claude Code stores in .claude/settings.local.json, sometimes with the sensitive command text unmasked.
Source details
Ars Technica · AI · Kyle Orland · arstechnica.comPublished · added here
Original title: Claude Code is accidentally exposing secrets all over GitHub