THE WORLD IS NOT STANDING STILL.RSS
BIG CHANGE.
BIG CHANGE, one tap away
BIG CHANGE, one tap away

Make room for the big picture.

Add BIG CHANGE to your home screen or desktop. It opens in its own window, with the latest stories when you’re online.

iPhone & iPad
Open bigchange.ai in Safari. Tap Share, then Add to Home Screen. Turn on Open as Web App if shown, then tap Add.
Android
Open bigchange.ai in Chrome. In the browser menu, choose Install app or Add to Home screen.
Desktop
In Chrome or Edge, use the install icon in the address bar or the browser’s app menu. In Safari on Mac, choose File → Add to Dock.

Markdown edition

# Claude Code approval files can retain exposed secrets

> Researchers examined public agent files and found credentials in repository history and settings.

By BIGCHANGE.AI Editorial

Published: 2026-11-10T17:50:38.897Z
Updated: 2026-11-10T17:50:38.897Z
Canonical: https://bigchange.ai/blog/claude-code-approval-files-secrets

![A developer reviews abstract lines on a desktop monitor.](https://bigchange.ai/api/media/file/settings-review-concept.png)
AI-generated conceptual illustration for BIG CHANGE

Security researchers say a convenience feature in Claude Code can preserve a sensitive command in a project settings file that may later become public. Anthropic's Claude Code lead says the team is exploring ways to prevent secrets from being saved.

## The big change

- **What changed:** Researchers measured exposed agent files.
- **Why it matters:** An approval can outlast a command.
- **What to watch:** Existing history and credentials.

## How an approval becomes a record

A developer might ask a coding agent to connect to a database and approve a proposed command containing a password. An [August 2025 issue](https://github.com/anthropics/claude-code/issues/5544) reported that a standing approval saved a command, including credentials, in `.claude/settings.local.json`. [Apiiro](https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again) says it reproduced the behavior. If that file is committed to a public repository, the permission record becomes readable too.

Anthropic's [settings documentation](https://code.claude.com/docs/en/settings) distinguishes the local file from `.claude/settings.json`, a shared project file meant to be committed. On first writing the file in a Git repository, Claude Code adds a global exclusion; manually created files need protection until then. An ignore rule is not a substitute for checking files already tracked in a repository.

The 2025 issue was automatically closed after inactivity; that history does not by itself establish a fix.

## What the researchers measured

Apiiro says it examined public GitHub material between November 1 and 3 and found 2,539 distinct suspected credentials across 1,994 repositories, including current and historical settings and other agent files. In current local settings alone, it counted 1,122 files containing 1,379 such values among 104,185 files examined.

Classification combined format/context rules with masked language-model review, except some artifact categories used rules alone. It says it did not use the credentials or contact the hosts: a matched value was not necessarily active, and the results do not establish unauthorized access. The historical search covered 43,120 repositories, so its history count is a floor rather than a complete census. Apiiro sells application-security products.

## Response and practical checks

In a [November 7 discussion](https://news.ycombinator.com/item?id=50407882), Claude Code lead Boris Cherny said the tool historically had not scrubbed secrets and the team was considering ways to prevent it, including prototyping detection. He recommended automatic mode and secret scanning; the discussion did not announce a released fix. Automatic mode should not be treated as proof that sensitive commands cannot be saved.

[GitHub's documentation](https://docs.github.com/en/code-security/concepts/secret-security/secret-scanning) says secret scanning checks Git history and recommends rotating an affected credential when alerted. It also supports custom patterns; coverage depends on the secret type and configuration, so a clean scan alone is not proof that no password was exposed.

If an exposed credential is found, revoke or rotate it promptly and investigate its use under the organization's incident process. [Removing the current file](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository) alone does not erase old copies in history, forks or clones. Keeping secrets out of literal commands and using an appropriate secrets-management mechanism can reduce what gets copied into approval records.

## Sources

- [Apiiro research on agent files](https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again) — Research method, counts and limitations.
- [Claude Code settings documentation](https://code.claude.com/docs/en/settings) — Local and shared settings and Git excludes.
- [Claude Code issue 5544](https://github.com/anthropics/claude-code/issues/5544) — Earlier user report and issue history.
- [Claude Code lead's public response](https://news.ycombinator.com/item?id=50407882) — Discussion of potential safeguards.
- [GitHub secret scanning documentation](https://docs.github.com/en/code-security/concepts/secret-security/secret-scanning) — Scanning scope, patterns and response.
- [GitHub sensitive data removal](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository) — History, copies and secret handling.