Over 31,000 secrets — database passwords, AWS keys, SSH logins, Telegram tokens — have been found sitting in public GitHub repositories, all traceable to one button in Claude Code. When you click “Yes, and don’t ask again” on a permission prompt, Claude Code writes the exact shell command you approved, secrets and all, into .claude/settings.local.json. That file ended up committed. Some of those repos have been public for over 200 days. GitGuardian found 5,343 of those secrets are still valid today.
How the Button Works Against You #
Claude Code asks for permission before it runs shell commands. That permission dialog is well-intentioned — it keeps the agent from silently executing destructive or sensitive operations. But the “Yes, and don’t ask again” option does something most developers don’t expect: it stores the full text of that command as an allow rule in .claude/settings.local.json.
If your approved command was something like curl -H "Authorization: Bearer sk-prod-abc123" api.example.com, then sk-prod-abc123 is now sitting in a JSON file in your project root. Claude Code never inspects the command for secrets before writing it. It treats the string as configuration, not as sensitive data.
The file is not a secrets vault. It is a settings file that happens to contain literal command strings, and developers have been treating it like one while not knowing it existed.
The Numbers Are Not Theoretical #
Apiiro scanned 104,185 public copies of the file and found 1,379 real secrets — 379 database passwords, 43 SSH logins for public servers, 23 AWS keys — in 1,122 repositories. The Cloud Security Alliance published the full breakdown on November 8. GitGuardian then went wider and found 31,088 distinct secrets across 23,276 repos. The monthly peak was 12,535 occurrences in April 2026. Half the exposed files had been public for at least 217 days.
Standard secret scanners missed many of these. Gitleaks and TruffleHog together failed to flag 215 of the 1,122 repositories Apiiro identified. The files don’t pattern-match the way a raw .env file does.
Why Gitignore Didn’t Save You #
Claude Code does add .claude/settings.local.json to .gitignore when it creates the file inside a repo. Anthropic’s Claude Code lead, Boris Cherny, made this point on Hacker News when the report surfaced. He also acknowledged: “Claude Code has not historically scrubbed secrets,” and noted that auto mode and built-in secret scanning are being prototyped.
The gitignore protection breaks the moment the file is tracked. If a developer committed it once, forks inherit the committed version — not the gitignore rule. If the project was copied before Claude Code created the gitignore entry, the file travels without protection. The rule does not retroactively remove what was already committed to history.
It Was Not a Good Week for Claude Code #
The settings.json issue broke publicly on November 5. Two weeks earlier, on October 29, versions 2.1.312 and 2.1.313 of the Claude Code extension on Cursor’s marketplace were distributed with an SSH backdoor embedded in the extension bundle. The malicious update was live for roughly 11 hours and reached up to 5,000 developers. BleepingComputer has the full breakdown.
The backdoor added an attacker-controlled SSH key to ~/.ssh/authorized_keys labeled “svc-telemetry” and established a reverse tunnel to the attacker’s server. Uninstalling the extension does not remove the backdoor. If you used Cursor around October 29, run this check:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "COMPROMISED" || echo "Clean"
Anthropic released version 2.1.314 to both Open VSX and Microsoft’s VS Code Marketplace. That incident did not affect either of those channels — only Cursor’s marketplace was compromised.
Check and Fix Now #
If you use Claude Code, run these three commands across your repos:
git log --all -p -- .claude/settings.local.json
git rm --cached .claude/settings.local.json
echo ".claude/settings.local.json" >> .gitignore
Rotate every credential that appears anywhere in that file’s git history — not just the current version. Rotation comes first. Cleanup comes second. If you approved Claude Code commands that included API keys, database passwords, or tokens of any kind, assume those values are exposed until proven otherwise.
The pattern here isn’t specific to Claude Code. Cursor’s rules files, GitHub Copilot’s workspace settings, and similar AI tool configs are all candidates for the same problem. The category of “agent settings as code” is new enough that neither developers nor scanners have learned to treat these files as secrets artifacts. Qodo put it plainly: your agent’s settings are code now. Treat them accordingly.