Claude Code Secret Leak: The .claude/settings.local.json Trap and How to Protect Your Repos

Clicking "Yes, and don't ask again" in AI coding agents speeds up your workflow—but it may also be quietly saving your database passwords and API keys into a file that ends up on GitHub.

According to recent research by security firm Apiiro, more than 104,000 copies of .claude/settings.local.json were found exposed in public GitHub repositories. Out of those, 1,122 files contained active plaintext secrets such as database connection strings, cloud admin credentials, and production API tokens. Expanding the scan across git history and transcripts revealed 2,539 distinct secrets across 1,994 repositories.

How Does the Leak Happen?

1. Permission Persistence: When you approve a shell command in Claude Code with "Yes, and don't ask again", the full command is saved as an allow-rule inside .claude/settings.local.json.
2. Plaintext Credentials: If that command includes an inline token, connection string, or API key, it is stored verbatim in JSON.
3. Missing Project .gitignore: Claude Code relies on your local machine's global git exclude file rather than adding the path to the project's .gitignore. Once the repo is cloned elsewhere, built into a Docker image (COPY . .), or staged by a teammate, the local settings file gets committed and pushed.

1. Audit Your Current Repo & Git History

# Check currently tracked .claude files
git ls-files | grep -E '\.claude/'
 
# Check entire git history for committed settings files
git log --all --full-history -- "**/.claude/settings.local.json" "**/.claude/settings.json"

2. Lock Down .gitignore and .dockerignore

.claude/settings.local.json
.claude/*.local.*
.cursor/mcp.json

If the file is already tracked, untrack it without deleting it locally:

git rm --cached .claude/settings.local.json

3. Rotate Any Exposed Secrets

Deleting a file or rewriting the latest commit is never enough once a secret has been pushed. Immediately revoke and rotate any API keys, database passwords, or tokens that appeared in .claude/settings.local.json.