{"id":6976,"date":"2026-11-08T07:39:18","date_gmt":"2026-11-08T07:39:18","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak"},"modified":"2026-11-08T07:39:18","modified_gmt":"2026-11-08T07:39:18","slug":"claude-code-settings-local-json-secrets-leak","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/claude-code-settings-local-json-secrets-leak","title":{"rendered":"Claude Code Settings File Leaked Secrets to 1,122 Public GitHub Repos, Apiiro Says"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A convenience click in <a href=\"https:\/\/i10x.ai\/news\/product\/claude\">Claude<\/a> Code can turn a one-off approved command into a plaintext secret store. Security firm <a href=\"https:\/\/apiiro.com\/blog\/coding-agents-leaking-secrets-github-dont-ask-again\" target=\"_blank\" rel=\"noreferrer noopener\">Apiiro<\/a> reported on November 5, 2026, that choosing \u201cYes, and don&#8217;t ask again\u201d saves the approved shell command \u2014 word for word, password included \u2014 in a project file named .claude\/settings.local.json. Researchers say they found 1,122 public copies of that file on GitHub holding at least one secret. <a href=\"https:\/\/thehackernews.com\/2026\/11\/claude-codes-dont-ask-again-file.html\" target=\"_blank\" rel=\"noreferrer noopener\">The Hacker News<\/a> and <a href=\"https:\/\/itwire.com\/business-it-news\/security\/claude-code-approval-files-found-exposing-company-secrets-on-github-says-apirro-researchers\" target=\"_blank\" rel=\"noreferrer noopener\">iTWire<\/a> published independent recaps of the write-up on November 7. As of November 8, i10x found no public statement from <a href=\"https:\/\/i10x.ai\/news\/company\/anthropic\">Anthropic<\/a> confirming a product fix.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>The mechanism:<\/strong> Claude Code can save an exact approved Bash command as an allow rule in .claude\/settings.local.json. If that command contained a password, token or key, the secret is stored in plaintext.<\/li><li><strong>The count:<\/strong> Apiiro reported 104,185 public copies of the file in 103,617 repositories, and 1,122 copies (about 1.1%) holding at least one secret \u2014 1,379 distinct values in current copies.<\/li><li><strong>The wider exposure:<\/strong> Counting git history, shared .claude\/settings.json files and saved agent chat logs, Apiiro put the total at 2,539 secrets across 1,994 repositories. One notified company confirmed its key had been live.<\/li><li><strong>The catch:<\/strong> Claude Code adds a machine-local git exclude, not a project .gitignore. Removing the file does not clean history or forks. i10x found no public Anthropic fix statement as of November 8, 2026.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Apiiro researchers Shmulik Cohen and Matan Giladi published the findings on November 5. They searched public GitHub between November 1 and 3, according to iTWire, and notified affected organizations on November 2 and 3. The Hacker News reported that one company confirmed its exposed key had still been live.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By default, Claude Code asks before it runs most shell commands. If the user picks \u201cYes, and don&#8217;t ask again,\u201d the tool writes an allow rule to .claude\/settings.local.json inside the project, matching Anthropic&#8217;s permissions documentation. Sometimes that rule is a pattern, such as npm test *. Sometimes it is one exact command. When it is the exact command, any password or token typed into it is saved too.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The researchers reproduced the behavior with Anthropic&#8217;s latest models, Opus 5.5 and Fable 5.1, The Hacker News reported. In 539 of the 1,105 repositories they traced, a commit listing Claude as a co-author changed the file \u2014 which they take to mean Claude often commits the file itself. That is an inference from commit metadata, not proof that Claude introduced every secret.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Background: a local file that does not stay local<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Claude Code tries to keep the file out of git. The first time it writes settings.local.json in a git repository, it adds the path to the user&#8217;s global git excludes, Anthropic&#8217;s settings documentation says. Git on that computer then ignores the file in every repository. The protection stays on one user&#8217;s machine. It does nothing for a file that was already committed, and Claude Code never adds the path to the project&#8217;s own .gitignore, so the protection does not travel with the repo, a fresh clone, another laptop, or a folder that becomes a repository later.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Users had already flagged the behavior. The Hacker News cites an August 11, 2025 bug report that said approved commands with API keys and tokens were being stored word for word; an automated bot closed that report as \u201cnot planned\u201d on January 3 after 60 days without activity. A later report, <a href=\"https:\/\/github.com\/anthropics\/claude-code\/issues\/13106\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub issue #13106<\/a>, filed on December 4, 2025, described API keys landing in settings.local.json and then in a public repository because .claude\/ was not gitignored. An automated bot closed it as a duplicate. The Hacker News said the four related reports the researchers cited had all been closed by the same bot, the most recent on November 6, and that none received a reply from Anthropic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">iTWire notes that security firm ironPeak described a similar committed settings file in February 2026. Those earlier reports support the mechanism; they do not independently verify Apiiro&#8217;s new repository totals. Apiiro sells application and agent security products, which iTWire also flags as context for reading a vendor study.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Finding<\/th><th>What Apiiro reported<\/th><th>Caveat<\/th><\/tr><\/thead><tbody><tr><td>Public copies of .claude\/settings.local.json<\/td><td>104,185 copies in 103,617 repositories<\/td><td>Public GitHub search; collected 1\u20133 November 2026, per iTWire<\/td><\/tr><tr><td>Copies holding at least one secret<\/td><td>1,122 copies, about 1.1%<\/td><td>Apiiro did not test whether the secrets still work<\/td><\/tr><tr><td>Distinct secrets in current copies<\/td><td>1,379<\/td><td>Classified by known key formats, password-plus-public-server context, and an AI reviewer<\/td><\/tr><tr><td>Broader scan (history, shared settings, chat logs)<\/td><td>2,539 secrets across 1,994 repositories<\/td><td>Includes 734 secrets only in history across 509 repos, plus shared settings.json and transcripts<\/td><\/tr><tr><td>Database passwords \/ SSH \/ git-host tokens \/ AWS keys<\/td><td>379 database passwords; 43 SSH logins; 42 GitHub, GitLab and npm tokens; 23 AWS keys<\/td><td>Exposure finding, not a confirmed breach of those systems<\/td><\/tr><tr><td>How long they sat in public<\/td><td>Every secret-bearing file was still on the default branch as of the Monday before publication; median presence about 217 days<\/td><td>Deleting the current file does not remove git history or forks<\/td><\/tr><tr><td>Forks and Claude-coauthored commits<\/td><td>211 forks of 74 repositories; Claude listed as co-author on changes in 539 of 1,105 traced repos<\/td><td>Co-authorship does not prove Claude pushed every secret<\/td><\/tr><tr><td>Scanner blind spots<\/td><td>Of 1,122 secret-bearing files, gitleaks flagged 564 and TruffleHog 643; neither flagged 215<\/td><td>Most misses were passwords typed inside ordinary commands<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">How the leak works<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The failure is not a hostile prompt tricking the model into stealing a password. It happens in an ordinary, authorized workflow: a developer types a secret into a command, approves it so Claude Code will stop asking, and the approval record becomes another copy of the secret.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Among current secret-bearing files, more than a third opened a database directly, including 379 database passwords, The Hacker News reported. Other finds included 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. Among owners, Apiiro counted 63 organizations, mostly software companies of all sizes. The strongest cases, the researchers said, included a database vendor&#8217;s own admin-level cloud key and the owner password of a medical-records database.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As of the Monday before The Hacker News recap, every file with a secret was still on its repository&#8217;s default branch, and in half of those repositories it had been there for at least 217 days. Older versions of the file contained 734 more secrets across 509 repositories that no longer appear in any current copy, usually because the file was later deleted. Forks spread the files further: 211 forks of 74 repositories carried the same secrets as the originals.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Secrets also sat in 298 of 76,011 public copies of the shared .claude\/settings.json file, which teams often commit on purpose, mostly inside allow rules. Including those, the older versions, and saved agent chat logs, Apiiro&#8217;s extended total was 2,539 secrets across 1,994 repositories.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Of 16 coding agents whose documentation the researchers compared, Claude Code was the only one confirmed to save the full approved command in a project file by default, Apiiro said.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Common secret scanners miss many of these files because they look for known key formats. A password after PGPASSWORD=, sshpass -p, or mysql -p can look like an ordinary word in an ordinary command line. Copies that never reach GitHub still matter: the file is plain JSON in the project folder, and it can also travel inside an npm package, a Docker image, a zip archive or a synced folder.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What teams should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Apiiro&#8217;s advice, as summarized by The Hacker News, starts with rotation, not cleanup. Search the organization for .claude\/settings.local.json and .claude\/settings.json, including git history even where the files are gone. Rotate every password, token and key those files have ever held, then stop tracking the local file with git rm &#8211;cached .claude\/settings.local.json and add it to the repository&#8217;s own .gitignore. Open the file on each developer&#8217;s machine, even if it was never committed, and delete every rule that contains a secret.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The researchers also recommend keeping secrets out of commands \u2014 referring to them as variables from a secrets manager, such as $DB_URL, so the saved rule holds the variable name \u2014 and approving patterns such as Bash(npm run:*) instead of single commands. Security teams should treat agent folders such as .claude\/, .cursor\/, .gemini\/ and .specstory\/ as secret-bearing, like .env files, and make scanners catch passwords inside commands rather than only known key formats.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The trending claim that \u201cAnthropic has updated newer versions\u201d could not be verified from public sources as of November 8, 2026. i10x found no changelog note or company statement confirming a fix for this specific save-the-full-command behavior.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Pros and cons<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">For users<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Pro:<\/strong> Standing approvals save time on repeated, boring commands, which is why the \u201cdon&#8217;t ask again\u201d option exists.<\/li><li><strong>Con:<\/strong> A single approval can write a live password into a project path that looks \u201clocal\u201d but is easy to commit, copy or scan.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">For developers<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Pro:<\/strong> The fix path is concrete: rotate anything the file ever held, untrack it, add a project .gitignore rule, and approve patterns instead of exact secret-bearing commands.<\/li><li><strong>Con:<\/strong> Machine-local git excludes do not travel with the repo, and deleting today&#8217;s file leaves history, forks and packaged copies untouched.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">For companies<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Pro:<\/strong> Apiiro&#8217;s public counts give security teams a searchable filename and a clear playbook, including checks of agent folders in CI and pre-commit hooks.<\/li><li><strong>Con:<\/strong> Exposed database passwords, cloud keys and admin credentials create an incident-response job even when no confirmed abuse has been shown, and vendor tooling that writes secrets by default shifts the burden onto every customer.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What X is saying<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Security accounts treated the finding as a \u201crotate first\u201d problem, not a curiosity.<\/p>\n\n\n\n<blockquote class=\"twitter-tweet i10x-x-embed\"><p lang=\"en\" dir=\"ltr\">\u203c\ufe0f Claude Code&#x27;s &quot;Don&#x27;t Ask Again&quot; option can save passwords and API keys in plaintext. Apiiro found 2,539 exposed secrets across 1,994 public GitHub repos, including database credentials, SSH logins, and cloud keys. Deleting files doesn&#x27;t erase Git history.<\/p>&mdash; The Hacker News (@TheHackersNews) <a href=\"https:\/\/x.com\/TheHackersNews\/status\/2118960196987080801\" target=\"_blank\" rel=\"noreferrer noopener\">November 7, 2026 \u00b7 View on X<\/a><\/blockquote>\n\n\n\n<blockquote class=\"twitter-tweet i10x-x-embed\"><p lang=\"en\" dir=\"ltr\">&quot;don&#x27;t ask again&quot; shouldn&#x27;t mean &quot;save my password&quot;. claude code can save full commands, including secrets, in its local settings file. apiiro found secrets in 1,122 public copies of that file. if yours leaked: rotate the secrets first. deleting the file isn&#x27;t enough.<\/p>&mdash; Lenny Enderle (@lenny_enderle) <a href=\"https:\/\/x.com\/lenny_enderle\/status\/2118990376480419911\" target=\"_blank\" rel=\"noreferrer noopener\">November 7, 2026 \u00b7 View on X<\/a><\/blockquote>\n\n\n\n<blockquote class=\"twitter-tweet i10x-x-embed\"><p lang=\"en\" dir=\"ltr\">PSA for teams using AI coding agents: clicking &quot;don&#x27;t ask again&quot; in Claude Code can save the exact command, secrets included, in .claude\/settings.local.json. Apiiro found 1,122 public GitHub copies holding secrets. Gitignore it and rotate anything it ever held. #DevSecOps<\/p>&mdash; Josh Watson (@ilikejoshwatson) <a href=\"https:\/\/x.com\/ilikejoshwatson\/status\/2119064365404221542\" target=\"_blank\" rel=\"noreferrer noopener\">November 7, 2026 \u00b7 View on X<\/a><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Developer <a href=\"https:\/\/x.com\/cagatay_dev\/status\/2119211363432337894\" target=\"_blank\" rel=\"noreferrer noopener\">Cagatay<\/a> put the same warning more bluntly: \u201cif you ever clicked \u2018yes, and dont ask again\u2019 in claude code, open .claude\/settings.local.json.\u201d<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Critical analysis<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The important distinction is between exposure and confirmed compromise. Apiiro did not try the credentials, as both The Hacker News and iTWire emphasize. A value counted as a secret when it matched a known key format or when a password or token sat beside the address of a public server, and an AI reviewer also had to agree. That is a serious exposure finding. It is not, on its own, evidence that attackers used these secrets or that every classified value still works.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Even so, the design choice is hard to defend. Saving the exact approved command is convenient, and it is documented. Combining that with a protection that lives only in one user&#8217;s global git excludes \u2014 while never writing the path into the project&#8217;s .gitignore \u2014 makes accidental publication the default failure mode. The scanner misses sharpen the problem: passwords inside ordinary command lines are exactly the secrets teams are most likely to type once and forget.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The long median presence, about 217 days, also matters. A secret that has been on a default branch for months is not a same-day oops. Forks, packaged artifacts and chat logs extend the blast radius beyond the file sitting in HEAD today.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What&#8217;s still open<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Will Anthropic change Claude Code so standing approvals store patterns rather than exact secret-bearing commands, or move this file out of the project tree?<\/li><li>Will Anthropic add .claude\/settings.local.json to the project&#8217;s .gitignore by default, or reply to the closed GitHub reports?<\/li><li>How many of the 1,379 current secrets, or the 2,539 in the extended set, are still valid?<\/li><li>Have any of the exposed database, cloud or medical-records credentials been abused?<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\u270d\ufe0f About the analysis<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This independent, research-based i10x analysis draws on Apiiro&#8217;s November 5 research write-up (the page is script-rendered; figures were verified against recaps by The Hacker News and iTWire, which quote researchers Shmulik Cohen and Matan Giladi), Anthropic&#8217;s Claude Code settings behavior as described in those reports and in GitHub issue #13106, and public posts on X. Apiiro did not test the credentials, so the findings describe exposure, not demonstrated intrusion. i10x found no public Anthropic statement confirming a fix as of November 8, 2026. More on <a href=\"https:\/\/i10x.ai\/news\/company\/anthropic\">Anthropic<\/a> and <a href=\"https:\/\/i10x.ai\/news\/product\/claude\">Claude<\/a>.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/apiiro.com\/blog\/coding-agents-leaking-secrets-github-dont-ask-again\" target=\"_blank\" rel=\"noreferrer noopener\">Apiiro: coding agents leaking secrets via \u201cdon\u2019t ask again\u201d<\/a><\/li><li><a href=\"https:\/\/thehackernews.com\/2026\/11\/claude-codes-dont-ask-again-file.html\" target=\"_blank\" rel=\"noreferrer noopener\">The Hacker News: Claude Code\u2019s \u201cDon\u2019t Ask Again\u201d file exposes passwords and keys<\/a><\/li><li><a href=\"https:\/\/itwire.com\/business-it-news\/security\/claude-code-approval-files-found-exposing-company-secrets-on-github-says-apirro-researchers\" target=\"_blank\" rel=\"noreferrer noopener\">iTWire: Claude Code approval files found exposing company secrets<\/a><\/li><li><a href=\"https:\/\/github.com\/anthropics\/claude-code\/issues\/13106\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub issue #13106<\/a><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd2d i10x Perspective<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Agent tools now write durable permission files inside project folders, so a routine \u201cyes\u201d is also a credential-storage decision. The lesson is older than Claude Code: anything an assistant saves next to the code will eventually be committed, forked or scanned. Until coding agents treat standing approvals like secrets managers treat vault paths \u2014 patterns and variable names, never the secret itself, and a .gitignore rule that travels with the repo \u2014 every team using them needs to search history for .claude\/settings.local.json and rotate first.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Security firm Apiiro says Claude Code can save an approved shell command, password and all, in .claude\/settings.local.json when a user clicks \u201cYes, and don&#8217;t ask again.\u201d Researchers counted 1,122 public copies of that file holding at least one secret \u2014 1,379 distinct values \u2014 and a broader total of 2,539 secrets across 1,994 repositories once git history, shared settings and chat logs are included. Anthropic has not issued a public fix statement. Affected teams should rotate credentials before cleaning git history.<\/p>\n","protected":false},"author":2,"featured_media":6975,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"28"},"categories":[3,24,22,28],"tags":[],"companies":[39],"products":[51],"class_list":["post-6976","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-anthropic","category-claude","category-coding","category-security-defense","company-anthropic","product-claude"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Apiiro: Claude Code Settings Leak Hit 1,122 Repos<\/title>\n<meta name=\"description\" content=\"Apiiro found 1,122 public Claude Code settings.local.json files holding secrets after \u201cdon\u2019t ask again\u201d saved approved commands. Rotate keys first.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Apiiro: Claude Code Settings Leak Hit 1,122 Repos\" \/>\n<meta property=\"og:description\" content=\"Apiiro found 1,122 public Claude Code settings.local.json files holding secrets after \u201cdon\u2019t ask again\u201d saved approved commands. Rotate keys first.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-08T07:39:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/claude-code-settings-local-json-secrets-leak-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/claude-code-settings-local-json-secrets-leak#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/claude-code-settings-local-json-secrets-leak\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"Claude Code Settings File Leaked Secrets to 1,122 Public GitHub Repos, Apiiro Says\",\"datePublished\":\"2026-11-08T07:39:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/claude-code-settings-local-json-secrets-leak\"},\"wordCount\":2272,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/claude-code-settings-local-json-secrets-leak#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/claude-code-settings-local-json-secrets-leak-title.webp\",\"articleSection\":[\"Anthropic\",\"Claude\",\"Coding\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-08T07:39:18+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/claude-code-settings-local-json-secrets-leak\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/claude-code-settings-local-json-secrets-leak\",\"name\":\"Apiiro: Claude Code Settings Leak Hit 1,122 Repos\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/claude-code-settings-local-json-secrets-leak#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/claude-code-settings-local-json-secrets-leak#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/claude-code-settings-local-json-secrets-leak-title.webp\",\"datePublished\":\"2026-11-08T07:39:18+00:00\",\"description\":\"Apiiro found 1,122 public Claude Code settings.local.json files holding secrets after \u201cdon\u2019t ask again\u201d saved approved commands. Rotate keys first.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/claude-code-settings-local-json-secrets-leak#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/claude-code-settings-local-json-secrets-leak\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/claude-code-settings-local-json-secrets-leak#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/claude-code-settings-local-json-secrets-leak-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/claude-code-settings-local-json-secrets-leak-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"A clay-style file folder slightly open with glowing keys spilling out beside a navy shield on a bright studio floor\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/claude-code-settings-local-json-secrets-leak#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Claude Code Settings File Leaked Secrets to 1,122 Public GitHub Repos, Apiiro Says\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Apiiro: Claude Code Settings Leak Hit 1,122 Repos","description":"Apiiro found 1,122 public Claude Code settings.local.json files holding secrets after \u201cdon\u2019t ask again\u201d saved approved commands. Rotate keys first.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak","og_locale":"en_US","og_type":"article","og_title":"Apiiro: Claude Code Settings Leak Hit 1,122 Repos","og_description":"Apiiro found 1,122 public Claude Code settings.local.json files holding secrets after \u201cdon\u2019t ask again\u201d saved approved commands. Rotate keys first.","og_url":"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak","og_site_name":"i10X News","article_published_time":"2026-11-08T07:39:18+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/claude-code-settings-local-json-secrets-leak-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"Claude Code Settings File Leaked Secrets to 1,122 Public GitHub Repos, Apiiro Says","datePublished":"2026-11-08T07:39:18+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak"},"wordCount":2272,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/claude-code-settings-local-json-secrets-leak-title.webp","articleSection":["Anthropic","Claude","Coding","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-08T07:39:18+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak","url":"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak","name":"Apiiro: Claude Code Settings Leak Hit 1,122 Repos","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/claude-code-settings-local-json-secrets-leak-title.webp","datePublished":"2026-11-08T07:39:18+00:00","description":"Apiiro found 1,122 public Claude Code settings.local.json files holding secrets after \u201cdon\u2019t ask again\u201d saved approved commands. Rotate keys first.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/claude-code-settings-local-json-secrets-leak-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/claude-code-settings-local-json-secrets-leak-title.webp","width":1344,"height":768,"caption":"A clay-style file folder slightly open with glowing keys spilling out beside a navy shield on a bright studio floor"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/claude-code-settings-local-json-secrets-leak#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"Claude Code Settings File Leaked Secrets to 1,122 Public GitHub Repos, Apiiro Says"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"}}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/6976","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=6976"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/6976\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/6975"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=6976"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=6976"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=6976"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=6976"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=6976"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}