This is reported by Ars Technica.
The researchers found more than 100,000 instances of the local Claude Code settings file being published. Approximately 1,100 such files from 63 organizations contained secret data.
How sensitive data ends up on GitHub
When a user allows Claude Code to execute a command and selects "Yes, and don't ask again," the tool records this permission in the .claude/settings.local.json file. Sometimes the command ends up there in full — along with a password or access key, if they were in its text.
According to Anthropic's documentation, this file is added to the global .gitignore list, which usually prevents its publication. However, the rule is not stored at the repository level itself. Because of this, the file can be accidentally published, for example, after moving the project to another computer.
According to Apiiro, in many cases Claude Code itself added changes to this file to commits without user involvement.
Even after the file is deleted from the repository, sensitive data may remain in its copies — forks.
The results differ from Apiiro's estimate due to methodology. GitGuardian tracked file publications over time, including versions that were later deleted or overwritten, and checked the validity of the credentials.
The researchers found another leak path — public container images on Docker Hub. They discovered 613 unique secrets from Claude Code settings files, of which 99 were valid.
GitHub recommends that after a password or token is published, the first step is to revoke or replace it. Deleting the file does not remove already exposed data from all copies of the repository and its history.
How the Claude Code team responded to the GitHub leak
The problem was reported back in August 2025. Other reports also described cases where the file did not end up in the ignore list or sensitive commands were stored in another file. These bug reports were closed after 60 days without activity.
Claude Code creator Boris Cherny stated that the developers are studying how to prevent such situations. He advised users to use secret scanners and said that the team is considering the possibility of building such a check into Claude Code.
At the same time, scanners also miss some leaks. Of the approximately 1,100 public secrets discovered by Apiiro, 215 were not flagged by two popular scanning tools — gitleaks and TruffleHog.