Researchers find secrets in 1,122 public Claude Code settings files

Security company Apiiro found at least one secret in 1,122 public copies of Claude Code's local settings file on GitHub, The Hacker News reported. Apiiro did not test whether the credentials still worked, although one notified company confirmed its key had been live. Selecting "Yes, and don't ask again" can save an approved command verbatim, including passwords or tokens, in a project file. Claude Code's automatic exclusion uses one computer's global git settings and does not protect files already committed. Deleting the file leaves secrets in repository history and forks. Researchers recommend rotating credentials before cleanup; neither gitleaks nor TruffleHog flagged 215 of the affected files in their tests.