A developer’s local settings file can become a credential leak if it is committed to a public repository. PANews reported on November 10, 2026, citing Ars Technica, that security firm Apiiro found more than 100,000 Claude Code local settings files uploaded to public GitHub repositories.
About 1,100 of those files contained database passwords, API tokens, private keys or root login information. Apiiro identified 2,539 real credentials across 1,994 repositories, affecting 63 organizations, according to the report.
The reported path to exposure involves Claude Code’s “Yes, and don’t ask again” choice: the original text of a command containing a secret may be written to .claude/settings.local.json. If that file is later committed to a public repository by mistake, the secret can be exposed.
Original report (PANews) · Published November 10, 2026, at 19:43 (UTC+08:00).