GoKawiilApiiro finds 1,122 public GitHub repos leaking secrets via Claude Code settings file
Security firm Apiiro found that Claude Code's local project settings file, .claude/settings.local.json, can store approved commands verbatim—including passwords and API keys—when users choose 'don't ask again.' Scanning GitHub, researchers located 104,185 copies of the file across 103,617 repositories, with 1,122 copies containing at least 1,379 exposed secrets, including 379 database passwords. One notified company confirmed its leaked key was still active.