Claude Code settings.local.json May Be Leaking Your Passwords: How to Check Yours

Claude Code can save passwords and API keys you type into approved commands as plain text. They land in a file called .claude/settings.local.json, and security firm Apiiro found real secrets in 1,122 public copies of it. Checking your Claude Code settings.local.json file takes about two minutes, and you should do it before your next push.

Here’s the short version:

• Apiiro scanned 104,185 public copies of the file across 103,617 GitHub repositories, per AI Weekly’s report.
• 1,122 files (about 1.1%) held at least one secret, 1,379 in total.
• The trigger is choosing “Yes, and don’t ask again” on a shell command that contains a password or token.
• Apiiro did not test whether the leaked secrets still work.

What the Claude Code settings.local.json file actually stores

When Claude Code wants to run a shell command, it asks for permission. If you pick “Yes, and don’t ask again,” it saves that command as an allow rule so it never asks twice.

The catch is that it saves the whole command string. If you typed a database password or a token into that command, the secret goes into the file too, in plain text.

Reports differ on how well the file is ignored by git. One account says Claude Code adds it to your global ignore list, which doesn’t help a fresh clone or a repo you create later. Either way, treat it as unprotected until you’ve checked.

Apiiro also compared the docs of 16 coding agents. It says Claude Code was the only one confirmed to save the full approved command in a project file by default.

How many secrets did Apiiro find?

The numbers below come from the same Let’s Data Science write-up and match the AI Weekly figures. Some headlines say 2,539 secrets, but that total also counts other files and git history, so I’m using the settings-file numbers only.

Another 734 secrets sat in older versions of the file across 509 repositories. Those were removed from the current code but still live in git history. Apiiro says 63 organizations were affected, mostly software companies.

The scanners missed a lot too. Gitleaks flagged 564 of the files and TruffleHog flagged 643, and neither caught 215. So a clean scan result isn’t proof you’re safe.

How to check your repos in two minutes

Open a terminal in any project where you’ve used Claude Code. First, see whether git is tracking the file or has ever tracked it:

git ls-files .claude/settings.local.json
git log --all --oneline -- .claude/settings.local.json

If either command prints anything, the file is, or once was, part of your repo. Next, open it and look for anything that resembles a password, token, or key inside the allowed commands.

Then stop git from tracking it going forward:

echo ".claude/settings.local.json" >> .gitignore
git rm --cached .claude/settings.local.json

This only stops future commits. It does not scrub history, which is why the next section matters. If your team uses Claude Code, our guide to Claude enterprise security controls covers other settings worth reviewing.

What to do if you find a secret in the file

Rotate it first. Deleting the file doesn’t help if the repo was public, because forks and old commits keep the old copy. Apiiro found 211 forks carrying identical secrets.

Change the password, revoke the token, or issue a new key, then update whatever depends on it. After that, you can clean the history with a tool such as git filter-repo if you want to.

Going forward, keep secrets out of the command line. Use environment variables or a secrets manager, and approve commands one at a time when they touch credentials. It’s also worth reading how another add-on slipped into projects uninvited in our Postman plugin check.

Has Anthropic responded?

Not publicly, as far as the coverage shows. The researchers say four related bug reports were closed by an automated bot with no reply, and an earlier report was closed as “not planned” in January.

That comes from Apiiro’s account as relayed by the press, and I couldn’t confirm it independently. Keep an eye on Claude Code release notes for a fix that redacts command arguments or ignores this file by default.

Frequently Asked Questions

Is my Claude Code data leaking right now?

Only if you typed a secret into a command, chose “don’t ask again,” and then pushed the file to a public or shared repo. The file stays on your machine otherwise.

Where is the settings.local.json file?

It sits in the .claude folder inside each project where you’ve used Claude Code. It’s a hidden folder, so you may need to show hidden files.

Does deleting the file remove the risk?

No. Old commits and forks can still hold the secret, so rotate the credential before you do anything else.

Should I stop using “Yes, and don’t ask again”?

For commands that contain credentials, yes. For harmless commands like running tests, the risk is much lower.

My take: this isn’t a reason to drop Claude Code, but it is a reason to spend two minutes on housekeeping today. Add the file to your .gitignore, rotate anything that looks like a secret, and make “never paste a password into a command” a habit. A tool that remembers everything you approve needs a human who remembers what not to approve.