As reported by The Hacker News, security firm Apiiro has uncovered that 1,122 public copies of Anthropic's Claude Code settings file — .claude/settings.local.json — contain exposed secrets on GitHub, totaling 1,379 distinct credentials across more than 1,100 repositories.

AI Security Alert: As reported by The Hacker News, security firm Apiiro has uncovered that 1,122 public copies of Anthropic's Claude Code settings file — .claude/settings.local.json — contain exposed secrets on GitHub, totaling 1,379 distinct credentials across more than 1,100 repositories.

This is not a traditional CVE-class vulnerability. It is a dangerous design interaction between an AI coding assistant's convenience feature and developer version-control habits. Understanding why it matters requires looking at the mechanics — and the broader implications for AI-assisted development tooling.

The Mechanism: Where Convenience Becomes a Liability

Claude Code prompts users before executing shell commands. When a developer selects "Yes, and don't ask again," the tool writes an allow-rule into .claude/settings.local.json. If the approved command was an exact string rather than a pattern, any secret embedded in that command — a database password, an API token, a cloud provider key — is persisted in plaintext.

Anthropic's tool attempts to prevent this by adding the file to the user's global git excludes. But that protection is local to one machine and one user configuration. It does not propagate with the repository. Critically, Apiiro found that in 539 of 1,105 traced repositories, a commit listing Claude as a co-author modified the file — meaning the AI assistant itself is committing the secrets to git history.

The file was already committed. The global git exclude arrived too late. And once in git history, deletion of the working copy changes nothing — the secret persists across clones, forks, and cached copies indefinitely.

Who Is Affected

The Mechanism: Where Convenience Becomes a Liability
Any organization using Claude Code in repositories that are or were ever public — even briefly.
Teams with shared or contributed-to projects where contributors use Claude Code, since the file may be committed by someone outside the core team.
Private repository users are at lower risk of public exposure but still face insider threat and accidental sharing scenarios.
CI/CD pipelines that clone repositories may ingest these files, potentially exposing secrets in build logs or artifact stores.

Why This Matters Beyond Claude Code

This incident highlights a systemic problem with AI coding assistants: they generate artifacts — config files, command histories, session logs — that capture developer inputs in ways traditional tools did not. The attack surface introduced by AI tooling is not just prompt injection or model hallucination. It includes the filesystem and configuration side effects of AI-driven workflows.

Every AI coding assistant that persists user-approved commands or context locally needs to be treated as a potential secret-exposure vector. The industry needs secret-scanning at the point of file write, not just at the point of git commit or push.

Shield53 Recommendations

Immediate Actions

  • Rotate first, clean up second. Assume any secret that ever appeared in .claude/settings.local.json is compromised. Rotate every credential: API keys, database passwords, cloud tokens, service account credentials. Do this before removing the file or rewriting history.
  • Search all repositories — including archived and forked copies — for the presence of .claude/settings.local.json in both the current tree and full git history.
  • Add the pattern to pre-commit hooks and CI secret scanners. Configure tools like gitleaks, trufflehog, or GitHub's built-in secret scanning to flag this specific filename.
  • Audit git history using tools like git log --all --full-history -- .claude/settings.local.json across all branches and tags.

Longer-Term Hardening

  • Add .claude/ to project-level .gitignore in every repository where Claude Code is used, not just global git excludes.
  • Never pass secrets as inline command arguments. Use environment variables, secret managers, or temporary files that are git-ignored. If Claude Code needs a credential, inject it via a wrapper script that reads from a secrets store.
  • Review AI tool configuration policies. Establish organizational rules for which AI coding assistants may be used, which features (like "don't ask again") are permitted, and where their artifacts may be stored.
  • Deploy file-write-time secret detection. Pre-commit hooks operate too late for this class of leak. Consider runtime tools that scan files as they are written to disk by AI agents.

The broader lesson for defenders is this: AI coding assistants are not just text generators — they are active agents that write files, modify configs, and commit code. Treat their artifacts with the same security scrutiny you would apply to any automated process with write access to your repositories.