Claude Code Approval Settings Expose Thousands of API Keys and Secrets

The leakage pattern fluctuated significantly over time. According to Valadon, monthly leaks in settings.local.json peaked at 12,535 occurrences in April 2026 before declining to 959 in October, though GitGuardian noted that the underlying reasons for the drop remain unknown.

While Claude Code automatically adds .claude/settings.local.json to a project's local Git ignore configuration upon creation, GitGuardian highlighted that this safeguard often fails. The protection does not automatically apply across different repository clones, nor does it prevent exposure if the file was previously tracked or accidentally staged by a developer.

Standard security tools also struggle to catch these leaks. Conventional secret scanners frequently miss credentials stored in Claude Code configuration files because passwords embedded within arbitrary command arguments and environment variable assignments lack the structured, provider-specific formats that detection algorithms typically flag.

Docker containers compound the leak

The exposure extends beyond source code repositories into container registries. GitGuardian's audit of public Docker Hub images identified 613 distinct secrets across 543 image repositories and 7,625 tags, with 99 of those secrets still active upon discovery.

This secondary exposure occurs when developers build container images using the Docker COPY . . instruction to import their entire working directory. Unlike Git, the Docker build process does not automatically observe .gitignore rules. As a result, a local Claude Code configuration file excluded from version control can easily be packed into a publicly accessible container image unless developers explicitly filter it out using a .dockerignore file.

The scope of some individual container leaks was extensive. GitGuardian observed one valid Cloudflare API token distributed across 559 image tags, while a single database password was present in 643 tags spanning seven separate image repositories. Simply deleting the configuration file from a GitHub repository does not revoke or remove credentials that have already been compiled into published container layers.

What it means for developers

The findings highlight the security risks associated with local configuration files generated by AI coding tools. As engineering teams integrate multiple model providers into their workflows, credential management requires extra caution. Developers looking to simplify model access can try top AI models cheaply through one API at https://apixoai.online, but regardless of access methods, API keys should never be passed directly within shell command arguments.

To mitigate exposure, GitGuardian advises developers to treat configuration files generated by AI coding assistants as potential secret-bearing assets. Best practices include:

• Using environment variables rather than hardcoding sensitive tokens directly into terminal commands.
• Verifying that .claude/settings.local.json and similar tool configurations are explicitly included in both .gitignore and .dockerignore files.
• Including AI assistant configuration paths in routine secret scanning pipelines alongside standard .env files.
• Auditing previously published Docker images and GitHub repositories for residual credential files.
• Immediately rotating any credentials that may have been saved to local configuration files or committed to remote repositories.

In response to the report, Anthropic did not immediately respond to a request for comment from CSO. However, GitGuardian noted that Boris Cherny, the lead for Claude Code at Anthropic, acknowledged the issue. Cherny stated that the team is investigating the problem and exploring additional protective measures, including built-in secret scanning capabilities and an auto mode to refine command approval handling.

Source: Claude Code’s ‘don’t ask again’ button has a secrets-spilling problem — InfoWorld AI. Written by the Apixo team from that report.