A developer's local AI coding-agent settings can become a public credential leak if they are committed to a repository. In research published November 5, security company Apiiro says it found 2,539 distinct secrets across 1,994 public GitHub repositories by examining Claude Code settings, repository history and other files used by coding agents. Those are Apiiro's research findings, not a GitHub incident count or a VIBPS scan.
How can an approval rule contain a secret?
Claude Code's documentation says that choosing “Yes, and don't ask again” for a Bash command can save a permanent, repository-level permission rule in `.claude/settings.local.json`. The file is meant for one developer's local settings, and Claude Code tries to keep it out of Git; if someone creates it by hand, Anthropic says to add it to `.gitignore`. Apiiro describes a risky case where a developer approves a command containing a literal password, token or connection string. The saved command rule can then retain that text.
This is a workflow and repository-handling issue. The approval does not mean the model independently extracted every credential on a machine. Apiiro says the command may contain a secret because a person or agent placed it there for a task, and the rule can remain after that task has finished. Other files, such as shared settings and saved agent transcripts, can also be committed with sensitive text.
What did Apiiro actually count?
Apiiro says it searched 104,185 public copies of `.claude/settings.local.json` across 103,617 repositories. It classified 1,122 files, about 1.1%, as containing a secret. Its larger total of 2,539 covers distinct findings across those files, Git history, shared settings, agent transcripts, memory files and handoff notes. The researchers say the files they analyzed were on repositories' default branches on November 2, 2026.
The scanner comparison is also specific to Apiiro's sample: it says Gitleaks flagged 564 of the 1,122 files and TruffleHog flagged 643, while 215 were flagged by neither. Apiiro attributes many misses to passwords embedded in ordinary command text rather than recognizable provider-key formats. This does not establish that either scanner will miss the same proportion in another codebase.
Does that mean 2,539 live credentials were verified?
No. Apiiro says it did not use or test any credential and did not contact the associated hosts. In its method, a “real secret” means a value matching a known provider pattern or a password or token next to a public host; the researchers do not claim every value was still active. Apiiro says one company confirmed that its key had been live, while the rest were not independently validated as usable. Treat the count as the research team's classified exposure findings, not a count of confirmed working accounts.
What should a maker check now?
- Inspect `.claude/settings.local.json` and shared `.claude/settings.json` for literal passwords, tokens, keys and connection strings. Also check saved agent transcripts and handoff files if they are stored in the project.
- Check Git history as well as the current working tree. Deleting a file now does not remove old commits, forks or clones that may contain it.
- If a credential may have been exposed, revoke or rotate it with its provider first. GitHub's remediation guidance treats a leaked secret as compromised; removing the text alone does not stop someone from using a valid credential.
- Keep local settings out of the repository with a project `.gitignore` rule, and prefer secret-manager or environment-variable references over pasting literal values into commands or agent conversations. Review the command before choosing a permanent approval.
A passing secret scanner is not proof that every password-like value is safe: its coverage depends on the patterns and checks it supports. Apiiro's report is a reason to include agent configuration and command logs in a repository review, while keeping its unverified-validity caveat attached to the headline numbers. Makers can also use VIBPS's practical guide to protecting an app while working with an AI coding agent.