# Claude Code settings files exposed thousands of secrets in public GitHub repositories > Apiiro found 2,539 valid secrets in public GitHub repositories containing Claude Code settings files. The findings show how saved command permissions can carry credentials into public code. > > OpenCheese AI · 2026.11.09 · Web page: https://opencheese.dev/blog/claude-code-settings-files-exposed-thousands-of-secrets-in-public-github-reposit A command approval meant to save developers a few prompts can also save their passwords in a project file. Apiiro found 2,539 valid secrets across 1,994 public GitHub repositories containing copies of a Claude Code settings file, including database passwords, API tokens and cloud keys with administrative privileges. ## How an approval becomes a saved secret Claude Code can remember permission to run a command. When a developer selects "Yes, and don't ask again," the agent saves the approved command in a settings file inside the project folder. If the command contains a password or access token, that credential is saved with it. The convenience is plain enough. A developer can approve a command once instead of repeatedly answering the same permission prompt. The risk appears when the settings file goes into a public repository alongside the code. Apiiro found 104,185 public copies of the files across 103,617 GitHub repositories. Of those repositories, 1,994 contained valid secrets. The findings do not mean Claude Code created every exposed credential or every commit that published one. Among 1,105 repositories where researchers found real secrets, Claude participated in creating the commit containing the sensitive file in 539 cases. The reported figures do not explain the relationship between that group of 1,105 and the broader count of 1,994 repositories. Most affected projects belonged to individual developers, but Apiiro also identified 63 affected organizations, including startups, software companies and large software vendors. The exposed credentials included an administrative cloud key belonging to a database provider, a production Azure PostgreSQL database password, a working Square token and an owner password for a medical records database. ## The ignore rule has limits Claude Code tries to keep the settings file out of version control by adding it to the developer's global .gitignore when the file is created. That file tells Git which files to ignore, but a global rule lives in the developer's own configuration rather than in the project's .gitignore. That distinction matters when a project moves between machines or contributors. The global rule does not travel with the repository. It also does not cover every scenario described in the report, including repositories created later inside an existing folder and files a developer has already added to a repository. Boris Cherny, who leads Claude Code development, said Anthropic is studying ways to prevent such exposures. He said the settings file is not intended for publication in version control and that the cases identified involved developers manually creating and adding it to repositories. ## Why scanners can miss the credentials A secret scanner may look for recognizable service key prefixes or long, random-looking strings. Credentials embedded in ordinary-looking shell commands do not necessarily fit those patterns. Apiiro said tools such as Gitleaks and TruffleHog can miss passwords supplied through PGPASSWORD=, sshpass -p or mysql -p. Tokens placed in authorization headers in curl commands can also go undetected. A clean scan is therefore useful evidence, not a guarantee that a repository contains no exposed credentials. The researchers also found sensitive information in other artifacts associated with AI agents, including conversation histories, memory files, handoff notes, deployment notes and VS Code Copilot settings for automatic command approval. Similar files appeared in repositories on Hugging Face and GitLab. Apiiro warned that the same kinds of information could reach published packages, Docker images and project archives. ## What developers can do Apiiro recommends removing permission rules that contain plaintext secrets and immediately changing each compromised password or key. Deleting the current file alone is not enough, because its contents can remain in Git history, versions and local copies of a repository. The company also advises against putting credentials directly into commands. Its recommendation is to use environment variables that refer to secrets held in dedicated secret managers. Developers should treat folders named claude, cursor, gemini and specstory, along with AI agent memory files, as potentially sensitive, much like .env files. Cherny also recommended using Auto mode rather than manually managing command allow and deny lists, and enabling GitHub secret scanning regardless of which AI agent is in use. The lesson is in the file that seemed too mundane to check. A saved permission can be a saved command, and a saved command can contain the keys to a production database. ## Related posts - 2026.11.02 · [Open model GLM 5.3 turned unreleased Firefox patches into working exploits in Epoch AI test](https://opencheese.dev/blog/open-model-glm-5-3-turned-unreleased-firefox-patches-into-working-exploits.md): Epoch AI gave the open model GLM 5.3 a Firefox version number and public code changes. It built working exploits for six releases, each in 12 to 48 hours. A similar attack on Chrome failed. - 2026.10.17 · [India's CERT-In says AI agents from several providers reached live systems and read personal data](https://opencheese.dev/blog/india-cert-in-ai-agents-accessed-live-systems-personal-data.md): India's cybersecurity agency says agents from multiple AI providers, running research and evaluation tests, got into Indian organizations' live systems through exposed credentials and read personal data and confidential records. - 2026.09.01 · [OpenCheese Now Supports More Coding Tools - Because Apparently One Wasn’t Enough](https://opencheese.dev/blog/opencheese-now-supports-more-coding-tools-because-apparently-one-wasn-t-enough.md): OpenCheese now supports OpenCode, Claude Code, Codex, Harness AI, VS Code, IntelliJ, Zed, and more. Sign in to find straightforward configuration help and connect your preferred coding environment without turning API setup into a weekend project.