Apiiro finds real secrets in 1,122 public Claude Code settings files

When you approve a Claude Code command with "Yes, and don't ask again", it saves that exact command, including any password or token typed into it, to .claude/settings.local.json in the project folder. Security firm Apiiro checked 104,185 public copies of that file on GitHub and found 1,122 holding a real secret, such as database passwords, Supabase keys and SSH logins. Counting git history, shared settings files and agent transcripts, it found 2,539 secrets in 1,994 repos, and in 539 of 1,105 traced repos a commit co-authored by Claude changed the file. Claude Code adds the file to the developer's global git ignore, not the repo's own .gitignore, and gitleaks and TruffleHog both missed 215 of the files, mostly passwords inside commands. Apiiro did not test any credential, so "real" means a known key format or a public host, not confirmed live access. HN (95 comments): Boris from the Claude Code team said the file is meant to stay local, is ignored automatically when Claude creates it, and that the team is looking into preventing this. No consensus. One camp calls it ordinary user error: people committed a local file with plain-text secrets. Another says Anthropic is passing the buck, since writing secrets to a file was foreseeable. A side debate split over whether auto mode is safer than manual approval without a real sandbox. Sorted take: the fix is cheap, so do it now rather than wait for a product change.