Researchers at Apiiro found 1,122 public GitHub repositories with a password, key or token committed in a Claude Code settings file. Two popular secret scanners together missed 215 of those files. We checked our own scanner against the same kind of file, and it missed most of them too.
Claude Code asks before it runs most shell commands. If you answer “Yes, and don’t ask again”, it saves an allow rule in .claude/settings.local.json in the project. Sometimes the rule is a pattern, such as Bash(npm test:*). Sometimes it is the exact command you approved. If that command had a password in it, the password is now in the file in plain text.
Claude Code tries to keep the file out of git. It adds the file to your global git excludes on your own machine. It does not add it to the project’s .gitignore, so the protection does not travel with the code. A teammate without that setting, a copied folder or a forced add can commit it. In 539 of the 1,105 repositories the researchers traced, the commit that changed the file listed Claude as a co-author.
| What the researchers found on public GitHub | Count |
|---|---|
Copies of .claude/settings.local.json | 104,185 |
| Copies holding at least one secret | 1,122 |
| Distinct secrets in them | 1,379 |
| Database passwords | 379 |
| SSH logins | 43 |
| GitHub, GitLab and npm tokens | 42 |
| AWS keys | 23 |
The shared .claude/settings.json, which teams commit on purpose, had the same problem in 298 copies.
The usual advice is to approve a pattern rather than one exact command. That works for npm test. It does not work when the password is the first thing in the command.
We searched our own laptops and found this rule:
"Bash(PGPASSWORD=<the password> psql:*)"
Claude Code offered a pattern, and the pattern began with a database password. The same file held that password in 12 more rules. It was never committed, because that repository’s own .gitignore excludes the .claude folder. We have removed those rules.
Vybscan now looks for passwords inside commands. It flags a password set in front of a command, such as PGPASSWORD=…, a password passed as a command flag, and a token in an Authorization header. It reads coding-agent settings files such as .claude/settings.local.json first, so a large repository cannot push them out of the scan. On the saved rules we tested, it went from finding 2 in 10 to all 10.
Vybscan checks every pull request, so a settings file with a password is flagged before it merges. A full scan finds the ones already committed. If it finds one, change that password. Deleting the file does not remove it from git history.
Sources: The Hacker News (7 November 2026), reporting research by Apiiro ยท Claude Code permissions and settings documentation.
Code, dependencies and secrets on every pull request, the same way every time.
Try Vybscan โ