Claude Code settings files on GitHub leak thousands of secrets, Apiiro finds

Claude Code is accidentally exposing secrets all over GitHub

Apiiro security researchers found thousands of sensitive items in Claude Code settings files committed to public GitHub repos, including database passwords, API tokens and root login credentials. The files were exposed because command authorization rules store sensitive data in local settings.

Why it matters: Apiiro found that Claude Code's command authorization rules save sensitive data, so committing the local settings file to a public repo can expose credentials.