Ars Technica AI says Claude Code settings files may expose secrets on GitHub

According to Ars Technica AI, Apiiro researchers found that Claude Code settings files can leak into public GitHub repositories and expose thousands of secrets. The exposed data reportedly includes database passwords, API tokens and root logins. The issue stems from how Claude Code stores user approval for automated shell commands in a local .claude/settings.local.json file. Anthropic says that file is usually added to a developer’s global .gitignore, but mishandling can still leave it public.