Claude Code Leaks Secrets in Settings File Across 1,122 Repos
Anthropic's Claude Code AI coding assistant saves verbatim shell commands — including embedded passwords and API keys — to a local settings file when developers select 'Yes, and don't ask again.' Security researchers at Apiiro discovered 1,122 public GitHub repositories containing this file with at least 1,379 exposed secrets, including database passwords, SSH credentials, and AWS keys. The leak is compounded by Claude Code's failure to add the file to project-level .gitignore, meaning the protection does not travel with the repository and git history preserves the exposure even after file deletion.