Claude Code is accidentally exposing secrets all over GitHub

Apiiro researchers found thousands of secrets, including database passwords, API tokens, and root logins, in Claude Code settings files embedded in public GitHub repositories. The leak stems from how Claude Code stores approved shell commands in the local ".claude/settings.local.json" file, sometimes writing the command as-is with any embedded sensitive information. Anthropic's documentation says this settings file is added to the developer's global .gitignore list, which usually prevents it from being shared publicly.