A configuration file meant to store local command permissions on Anthropic’s Claude Code is exposing thousands of API keys, database credentials and other secrets, according to findings by GitGuardian.
The code security firm identified 31,088 distinct secrets in Claude Code’s “.claude/settings.local.json” files across 23,276 public GitHub repositories. Of those, 5343 were still valid when GitGuardian detected them. The exposed credentials include database connection strings, cloud provider tokens, SSH passwords, Google API keys, and AU service credentials.
“Monthly leaks in settings.local.json peaked at 12,535 occurrences in April 2026, then fell to 959 by October, and we do not yet know what changed,” GitGuardian researcher Guillaume Valadon said in a blog post.
Apart from source code repositories, the exposure included secrets embedded in publicly accessible Docker Hub images. The problem, Valadon explained, lies with how Claude Code handles command approvals.
Command approvals turn into credential storage
Claude Code asks developers for permission before executing certain shell commands. When a developer selects the “Yes, and don’t ask again” option, the tool saves an allow rule in .claude/settings.local.json, a project-level configuration file.
The catch is that the saved rule contains the actual command string, including any credentials embedded in it.
For instance, a developer asking Claude Code to interact with an API might approve a curl command containing an API key in its HTTP header. Claude Code then stores that entire command as an approved rule, leaving the credential in the configuration file.
Although Claude Code automatically adds the file to its local Git ignore settings, that protection does not necessarily carry over to other machines or repositories, Valadon said. Developers can accidentally commit the file, particularly when working across different clones or when the file has already been tracked.
Git Guardian found that 67% of the occurrences in settings.local.json for which it could establish validity were working credentials. Database identifiers accounted for the largest category of valid secrets, with 2280 distinct credentials, followed by cloud provider tokens and AI tokens.
It was also noted that conventional secret scanners could miss a substantial portion of the exposure. Passwords embedded in command-line arguments and environment variable assignments often lack the recognizable formats that provider-specific detection rules look for.
Leaked credentials on Docker Hub
GitGuardian also examined public Docker Hub images and found 613 distinct secrets in Claude Code settings files, 99 of which were valid when detected.
The credentials appeared across 543 image repositories and 7625 tags. According to Valadon, the problem arises when developers use Docker’s “COPY..” instruction to copy an entire project working directory into an image.
Unlike Git, Docker does not automatically respect the repository’s .gitignore file. Consequently, a Claude Code configuration file excluded from version control can still be copied into a container image unless developers explicitly exclude it through .dockerignore.
One valid Cloudflare API token appeared across 559 image tags, while a database password appeared in 643 tags across seven image repositories.
Removing the offending file from the GitHub repository does not help the credentials already distributed through published images. Developers must rotate exposed credentials, remove sensitive configuration files from both Git and Docker build contexts, and check previously published images for lingering secrets.
GitGuardian recommends treating AI coding assistant configuration files as potential secret-bearing assets, scanning them alongside conventional environment files, and using environment variables rather than hardcoding credentials into commands.
Anthropic did not immediately respond to CSO’s request for comment. GitGuardian said Anthropic’s Claude Code lead Boris Cherny acknowledged the issue, saying the company was looking into it and exploring additional safeguards, including built-in secret scanning and an auto mode.
No Responses