31,088 secrets in Claude Code's .claude/settings.local.json on public

GitGuardian published security research revealing 31,088 distinct secrets exposed in Claude Code configuration files across 23,276 public GitHub repositories, according to blog.gitguardian.com's report. The dataset spans January 2025 through November 7, 2026, and confirms that 5,343 of those credentials remained active and functional when automated validation checks examined them. Claude Code records full terminal command strings into local project configuration files when developers select persistent command execution approvals. Because these settings files often escape local project boundaries during branch management, repository clones, and container builds, live credentials spanning database systems, cloud providers, and artificial intelligence model gateways regularly leak into public version control and container registries.

This investigation analyzes how persisted permissions create credential exposure across development environments, continuous integration systems, and container registries, providing engineering teams with concrete remediation steps. It details the exposure volume across configuration formats, contrasts current repository snapshots with historical pipeline commits, examines automated scanner detection gaps, and maps credential traversal into container images. Security leads, site reliability engineers, and developers who deploy autonomous terminal agents like Claude Code or Codex need this data to audit access logs, configure project ignore files, rotate compromised tokens, and prevent automated command approvals from persisting sensitive infrastructure credentials into shared repositories.

What shipped in 31

GitGuardian released a comprehensive analysis of credential exposure originating from Claude Code settings files, uncovering 71,525 total occurrences of .claude/settings.local.json across 23,276 repositories authored by 11,336 developers. The research also mapped 17,705 occurrences of .claude/settings.json across 6,839 repositories and 2,988 authors, yielding an additional 8,271 distinct secrets with 1,283 active credentials. The root cause centers on command approvals: when an engineer instructs Claude Code to query an internal service and selects the option to never ask again, the agent writes an allow rule directly to the local configuration file. That rule retains the raw command string, including inline flags, authentication headers, environment variables, and plaintext access tokens.

The exposure expands significantly beyond source control when automated container pipelines package the host filesystem without filtering hidden workspace directories. GitGuardian detected 109,284 secret occurrences in settings.local.json and 29,613 in settings.json across 543 public Docker Hub repositories spanning 7,625 image tags. Approximately 72 percent of those files resided in root build paths like /app, /workspace, or /usr/src, caused by Dockerfile COPY instructions transferring the entire working tree rather than the git index. A total of 613 distinct secrets reached Docker Hub, with 99 verified live upon detection. In one instance, a single working Cloudflare token replicated across 559 image tags, while a database password appeared across 643 tags.

What improved in 31

The findings clarify the discrepancy between single-point repository scans and continuous commit monitoring, reconciling GitGuardian's historical telemetry with earlier figures published by Apiiro on November 5. While code search across default branches identified 1,379 exposed secrets in active files and 734 in git history across 43,120 repositories, commit-level ingestion captured 31,088 distinct credentials pushed over time. Continuous monitoring verified that monthly leaks in settings.local.json dropped 92 percent from their peak of 12,535 occurrences in April 2026 down to 959 occurrences in October 2026, while settings.json dropped 84 percent from its May 2026 peak of 3,084 down to October.

Automated verification established that 17 percent of all detected unique credentials in settings.local.json worked upon discovery, led by 2,280 database identifiers, 971 cloud provider keys, and 583 artificial intelligence service tokens. Valid database secrets contained 1,955 distinct Postgres connection strings across 5,076 valid occurrences, 292 SSH passwords, and 116 MongoDB URIs. Apiiro noted that generic tools like TruffleHog and gitleaks miss roughly 20 percent of leaking files because 63 percent of detections in settings.local.json involve unstructured strings lacking vendor prefixes. When passwords follow command prefixes like PGPASSWORD without vendor signatures, standard pattern scanners overlook the files entirely.

What you gain from 31

Understanding the mechanics of persisted approval rules allows engineering teams to implement targeted defenses against credential exfiltration. Analysis of 3,000 rule occurrences demonstrated that every detected secret resided in allow rules or environment blocks, with zero appearances in deny blocks. Standard curl invocations accounted for 50 percent of all approved command rules, leaking bearer tokens, session cookies, and authorization headers, though exhibiting low validation longevity. In contrast, database commands and environment prefixes accounted for 19 percent of occurrences but yielded the highest validation rates, including SSH passwords at 54 percent and database connections exceeding 50 percent.

The data also isolates the distinct risk profiles between shared project settings and individual workstation configurations. While settings.local.json captures interactive shell commands, the shared settings.json file leaks third-party gateway credentials defined in team environment blocks. Approximately 25 percent of leaking settings.json files contained ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN definitions routing requests to external inference hosts, exposing 205 valid DeepSeek keys, 62 OpenRouter keys, and 50 MiniMax keys. Conversely, genuine Anthropic keys numbered only 139 across settings.local.json with 28 valid, confirming that engineers rarely expose primary provider tokens compared to downstream proxy credentials.

How to get 31

Remediating existing workstation leaks and updating Claude Code requires developers to upgrade their global package installation, verify configuration rules, and explicitly exclude sensitive metadata paths across version control and container build pipelines. Administrators should refresh their CLI client to the latest release, inspect existing persistent permissions stored under project paths, and adjust automated agent execution flags before running further coding sessions.

npm install -g @anthropic-ai/claude-code
claude update
claude --model fable
/model claude-fable-5-1

To prevent uncommitted files from reaching remote servers or container registries, teams must ensure that project root configurations declare proper boundary rules. Adding .claude/ to .gitignore stops tracked additions on fresh machines, while adding .claude/ to .dockerignore ensures that wholesale directory copies in Dockerfiles do not bundle local approvals into distributed registry tags. Furthermore, developers should inspect CLAUDE.md files, which exposed 6,155 distinct secrets with 2,537 valid credentials, ensuring instructions rely entirely on sanitized shell references and environment variables stored securely in system credential managers.

What to watch after 31

Multi-agent ecosystem hygiene remains an active industry challenge, as comparative evaluations across 30 distinct artificial intelligence development tools confirmed credential exposure in every agent configuration format. Most systems leak third-party credentials through Model Context Protocol definitions and static environment blocks, but Claude Code proved unique in serializing complete shell execution strings to disk upon user approval. Security teams must also monitor agent authentication state files stored within user home directories, such as .claude/.credentials.json, which appeared across 371 public repositories with 1,366 OAuth tokens, and OpenAI Codex's .codex/auth.json, which surfaced across 536 repositories with 1,064 tokens.

Organizations must determine whether the 92 percent reduction in leaking occurrences between April and October 2026 stemmed from client-side permission prompt redesigns, platform push protection, or shifting developer adoption patterns. Repository administrators should audit active database instances, cloud infrastructure keys, and third-party gateway accounts for historical exposure, rotating all credentials detected across public commits. Because removing files from default branches does not invalidate existing Docker Hub layers or git histories, security groups must assume exposed credentials remain compromised until revoked and replaced with scoped, short-lived tokens.