Apiiro researchers Shmulik Cohen and Matan Giladi found credentials in coding-agent settings published on GitHub. Their November 5 investigation traces one route through Claude Code’s saved command approvals: a command containing a secret can become a persistent permission rule inside the project.

A saved rule alone does not make a credential public. Exposure requires another step, such as committing the file to a public repository or including it in an artifact. Private copies still expand access to anyone who can read them.

A remembered command can outlive the session

When a developer selects an option to stop asking about a command, Apiiro reports that Claude Code can save the command, including an embedded password or token, in .claude/settings.local.json. An August 2025 issue independently reported the same plaintext-storage behavior.

Anthropic’s settings documentation says the local file is for personal project settings and that Claude Code keeps it out of Git when it creates the file. Apiiro says this protection does not cover every path, including files created before a folder becomes a repository or copies made on another machine. Shared .claude/settings.json is intended to be committed, so its contents also deserve review.

Apiiro examined public GitHub files and reports potential credentials in 1,122 of 104,185 local-settings files. Across settings, history and other agent artifacts, its researchers counted 2,539 distinct apparent secrets in 1,994 repositories. They also found credentials in shared settings and some exported conversations.

Evidence status: vendor-reported exposure, not a count of confirmed compromises. Apiiro says it did not test credentials or contact their hosts. It used pattern checks and masked-context review, and one notified organization confirmed a key had been live. Apiiro sells development-security products.

Treat approvals and history as secret-bearing

  • Review saved permissions and shared settings for literal passwords, tokens and connection strings. Restrict who can read copies on developer machines and in repositories.
  • If a credential was exposed, revoke or rotate it first. Removing a file from the current branch does not remove it from history, forks, clones or published artifacts.
  • Keep local settings out of project commits with a repository ignore rule, and check whether the file is already tracked. An ignore rule alone does not untrack an existing file.
  • Avoid putting secret values directly in commands. Use an appropriate secret-delivery mechanism and check whether its output can still be logged or copied into an artifact.
  • Scan history and agent artifacts as well as source code. Apiiro reports that two scanners missed some passwords embedded in commands. Review scanner coverage rather than treating a clean result as proof.

Use narrow permissions for any saved approvals. Broad command patterns can create their own authorization risk even if they avoid saving a literal secret.

What the thread adds

In the Hacker News discussion, bcherny, identifying himself as a Claude Code team member, says the tool historically has not scrubbed secrets and that the team is looking at prevention. He says Claude Code automatically ignores the local file when it creates it; Apiiro’s report describes gaps in that protection and files changed in agent-coauthored commits.

Aurornis distinguishes saving a secret from publishing the file. Researcher shmulc agrees on the chain and points to the project-level ignore gap. These are discussion participants’ accounts; the existence of a saved secret is not itself proof of public disclosure.

From a 134-comment thread, in HN’s own order.

Caveat: Apiiro’s credential classification is broader than verified live access, and its GitHub sample does not measure all agent users.