Came across a pretty sobering study by Apiiro: in Claude Code, click “Yes, and don't ask again,” and it writes the entire command you approved verbatim into the project file .claude/settings.local.json—including passwords and API keys in plain text.
They scanned public GitHub and found about 104,200 copies of this file (in about 103,600 repositories). Of those, 1,122 (about 1.1%) contained at least one secret, for a total of 1,379 unique secrets. Including Git history, shared team settings.json files, and agent conversation logs, they found about 2,539 secrets scattered across 1,994 repositories.
More than a third could be used to access databases directly; database passwords alone accounted for 379. There were also 43 SSH logins to publicly accessible servers, 42 GitHub/GitLab/npm tokens, and 23 AWS keys, affecting about 63 organizations. The researchers didn’t try these secrets to see if they worked, but one company they notified confirmed that its key was still active at the time.
Claude Code adds this file to your machine’s global Git excludes, but doesn’t add it to the project’s own .gitignore—so the protection fails if you switch computers or if the file has already been committed. Of the 1,105 repositories they tracked, Claude had modified this file as a co-author in 539. Comparing 16 coding agents, they confirmed that only Claude Code stores the full approved command in a project file by default.
The researchers recommend rotating every secret that has appeared in the file, then cleaning up the repository. Click “Don’t ask again” for convenience, and secrets end up written to a plaintext config file.
#ClaudeCode #网络安全 #AI