When Claude Code asks whether it may run a command and you answer "Yes, and don't ask again", it writes that command into .claude/settings.local.json at the root of your repository, so it can recognise the command next time. If the command carried a secret, the secret goes in with it.
The directory is not added to .gitignore. So the file sits in the working tree as an untracked file, and untracked files get committed.
Research published this month by Apiiro put numbers on what that produces. It examined 104,185 public copies of that file on GitHub and classified 1,122 of them as containing secrets. That is 1.08 percent. A wider sweep that also read git history, shared settings and agent transcripts counted 2,539 distinct secrets across 1,994 repositories, which works out at 1.27 secrets per affected repository.
Those counts are Apiiro's and we have not reproduced them. Everything below this line is from documents anyone can open.
Somebody reported this eleven months ago
On 4 December 2025, a developer using the handle andrehrferreira opened issue 13106 on the anthropics/claude-code repository. The title is "Sensitive tokens stored in .claude/settings.local.json and not ignored by git by default".
The body describes precisely what Apiiro found eleven months later. Keys written in plain text. The directory not added to gitignore. The file committed and pushed to a public repository. A secret-scanning alert firing on the leaked key. The reporter called it a regression, because it had worked in an earlier version.
Here is what happened to that issue.
| Date | What happened |
|---|---|
| 4 December 2025 | Opened. A bot posts three possible duplicates. |
| 8 December 2025 | A bot closes it as a duplicate of issue 11982. |
| 15 December 2025 | A bot locks it as resolved and limits the conversation to collaborators. |
No Anthropic maintainer ever replied. There are no human comments on the thread at all. There is one reaction, a thumbs up, from one person.
Now read the title of the issue it was closed as a duplicate of. Issue 11982 is called "Claude Code no longer adds local settings file to .gitignore when it is created".
The duplicate is correct. That is the same bug. And its title says, in plain words, that the product used to do the safe thing and stopped doing it.
From 4 December 2025 to today is 338 days. Nothing in the automated closure was wrong on its own terms: the issue genuinely was a duplicate, the bot genuinely did close duplicates, and the lock was the standard seven-day rule. Every individual step was correct and the file is still not in gitignore.
We checked our own
Root Notes is written with Claude Code and its repository is public, so this is our problem before it is anybody else's.
The file is there. .claude/settings.local.json is tracked by git, committed, and on GitHub right now. We read it. It contains four permission rules and nothing else: two for npm commands, one for a package lookup, one for a grep. No keys, no tokens, no environment values.
So: exposed to the pattern, clean on the content. We are in the 104,185 and not in the 1,122.
That is the check to run, and running it is faster than reading about it.
What to do, in this order
Rotate first. Anything that was ever in that file should be treated as published. Removing a file from the working tree does not remove it from history, and history is what gets cloned.
Then stop tracking it. Remove it from the index without deleting it from disk, add the whole .claude directory to your gitignore, and commit that.
Then check history, not just the current tree. If the file was committed at any point, the secret is in a past commit whether or not the current version is clean.
Then check your other tooling. Check Point separately found credentials in 33 files across 30 published npm packages, which is the same failure in a different wrapper: a local convenience file that nobody told the packaging step to exclude.
The part worth keeping
There is an uncomfortable symmetry in this one. A tool that exists to ask permission before doing something risky, which then records the answer somewhere risky. The feature is called "don't ask again" and the cost of using it is that the thing you approved is written down in a file that travels.
That is not an argument against the feature. It is an argument for the file living in your home directory rather than in the repository, which is exactly what the original reporter suggested on 4 December 2025, in the issue that a bot closed on 8 December 2025.
What is not established
- Whether any of the 1,122 exposed secrets still work. Apiiro did not test them. Separate reporting describes one organisation confirming its exposed key was live.
- Whether issue 11982 is still open, what its thread says, or whether a fix is planned. We read 13106, not 11982.
- Whether Anthropic has addressed this anywhere else, in release notes or documentation. We did not find a statement and did not ask the company.
- Whether 1.08 percent holds beyond Apiiro's sample, or how the sample was selected.
- Whether the behaviour has changed in a Claude Code release since December 2025. Our own copy of the file is tracked, which suggests it has not, but one repository is not evidence.
