Claude Code can save passwords and API keys in plain text to .claude/settings.local.json. If that file has reached a public repo, rotate every key it held, then clean it out of git history. Security firm Apiiro scanned 104,185 public copies of the file on GitHub on 1-3 November 2026 and found 1,122 holding at least one real secret, 1,379 distinct secrets in total (Apiiro). The cause is a convenience feature. When you choose "Yes, and don't ask again" on a Bash command, Claude Code saves that approval as a rule in this file, so any password or API key typed into the command goes with it (Claude Code Docs).
If you write integrations, run a broker or operate a node with an AI coding assistant, work through this checklist today. These figures are Apiiro's own findings and have not been independently verified.
1. Find every Claude settings file in your repos
Apiiro's broader scan of files written by AI coding agents found 2,539 real secrets across 1,994 public GitHub repositories, with most of them sitting in current or earlier committed copies of settings.local.json (Apiiro, scan run 1-3 November 2026). The shared .claude/settings.json file is not clean either: 298 of 76,011 public copies held a real secret.
Search every repo you own or contribute to for both files, and check git history as well as the latest commit. Open each copy and look for passwords, tokens, RPC URLs with embedded keys or private keys inside saved Bash rules.
2. Rotate every secret the file has ever held
Once a secret lands in a public repo, treat it as compromised. GitHub's incident response guidance says to rotate a credential if there is any possibility of exposure, and to generate new tokens and secrets to replace them (GitHub Docs).
Revoke and reissue API keys, RPC provider keys, broker and integration keys, and any signing keys. Node operators should follow the key management guidance in the official Chainflip docs rather than improvising.
3. Clean the file out of git history after rotating
Deleting the file in a new commit leaves the secret in git history, and forks and clones may still hold copies. Apiiro's advice, as reported by iTnews, is to rotate every credential before cleaning up for exactly this reason.
GitHub's guide to removing sensitive data from a repository covers history rewriting and warns of side effects, including a high risk of recontamination. Do it only after rotation, so any copy that survives is already worthless.
4. Add .claude/settings.local.json to your repo's .gitignore
Anthropic's .claude directory docs describe settings.local.json as your personal settings overrides for the project and mark it as gitignored. According to Anthropic's settings documentation, Claude Code adds the file to your global git excludes the first time it writes it in a repo that does not already ignore it. That only protects your own machine. A force-add or a copy committed from another setup can still expose it, so add the path to the repo-level .gitignore and commit that change.
5. Pass secrets through environment variables, not inline commands
The leak happens because the saved approval stores the command as you approved it, including any key you typed into it. Load credentials from environment variables or a secret manager so the command your assistant runs references a variable name, not the value. The same habit applies to Claude Code, Gemini in VS Code or any other AI coding assistant. Before approving a command permanently, confirm it contains no secret.
6. Turn on secret scanning for your repos
Claude Code team member Boris Cherny recommended secret scanning in a Hacker News reply, as reported by iTnews. Enable secret scanning on your GitHub organisation and repos so committed credentials raise an alert, and run a pre-commit secret scanner locally so credentials never leave your machine.
7. Take fixes only from official channels
Security news attracts follow-up scams, including fake patches and urgent-sounding support messages. The Chainflip team will never DM you a patch or ask for your keys or seed phrases. Get Chainflip updates from the official docs, blog and verified community channels, and Claude Code updates from Anthropic's own release notes.
Make secret hygiene part of your AI workflow
This behavior is not new. GitHub issue #5544, filed in August 2025, reported that approved Bash commands containing credentials were stored in plain text in settings.local.json, and it was closed as not planned. Anthropic has said it is looking into ways to prevent this, but as of 9 November 2026 we found no published fix or advisory, so the cleanup is on you.
If you're wiring assistants into anything that moves funds, read our breakdown of AI agent crypto swaps and what changes when assistants can execute cross-chain trades. Integrators earning swap broker affiliate fees should treat broker keys like revenue, because that is what they protect. Run the checklist today, then repeat it after your next long AI-assisted coding session.
Resources
Swap - Start swapping native assets
Lending - Borrow against native Bitcoin
Blog - Product updates and announcements
Chainflip Scan - Track swaps and network activity
Website - Explore Chainflip
Earn with Chainflip:
Boost - Earn fees by providing single-sided liquidity with no IL risk
Stablecoin Strategies - Deposit stablecoins and earn optimized yields
Provide Liquidity - Supply assets to Chainflip's liquidity pools
Stake FLIP - Delegate FLIP and earn staking rewards
Find us:
FAQ
Where does Claude Code store "Yes, and don't ask again" approvals?
Anthropic's permissions docs say Claude Code saves these rules to .claude/settings.local.json at the root of the git repository. For Bash commands the approval is permanent per repository and command, so any secret inside the command stays in the file until you remove it.
Has Anthropic fixed the Claude Code secret leak?
As of 9 November 2026 we found no confirmed fix, changelog entry or published advisory. A Claude Code team member said on Hacker News, as reported by iTnews, that the team is looking at what it can do to prevent this. Check Anthropic's release notes for updates.
Is deleting settings.local.json from my repo enough?
No. Copies remain in git history, forks and clones. Rotate every credential the file held first, then clean history following GitHub's guidance on removing sensitive data.
Does this only affect Claude Code?
The reported mechanism is specific to Claude Code's saved approvals. The lesson applies to any AI coding assistant that writes configuration into your project: keep secrets out of commands and out of committed files.
Will Chainflip contact me about exposed keys?
No. The Chainflip team will never DM you a patch or ask for your keys or seed phrases. Treat any message that does as a scam.
