{"type":"post","id":"claude-code-settings-local-json-secrets-17-months-9b923f","slug":"claude-code-settings-local-json-secrets-17-months-9b923f","title":"Claude Code settings.local.json Secrets: 17 months of exposure on GitHub, & Docker Hub","description":"GitGuardian says it found 31,088 distinct secrets in Claude Code’s project-level settings.local.json files across 23,276 public GitHub repositories, with 5,343 still valid when detected.","retrieval_nugget":"GitGuardian says it found 31,088 distinct secrets in Claude Code’s project-level settings.local.json files across 23,276 public GitHub repositories, with 5,343 still valid when detected. The report also found secrets in Docker Hub images. The mechanism matters to teams using coding agents: approving a command for repeated use can persist its literal credentials in a project file.","published_at":"2026-11-11","updated_at":"2026-11-11","record_date":"2026-11-11","date_kind":"published_at","topics":["github","claude","claude-code"],"entities":["GitGuardian","Claude Code","Anthropic","Apiiro","Docker Hub","GitHub"],"related_patterns":["agent-security-moves-to-runtime-boundaries"],"novelty_label":"new_fact","what_changed":"GitGuardian counted 31,088 secrets across 23,276 public GitHub repositories, including 5,343 valid credentials, and found 613 secrets in Docker Hub images, 99 still valid.","prior_refs":["https://newruntime.com/posts/clicking-yes-and-don-t-ask-again-in-852ac3/"],"source_url":"https://blog.gitguardian.com/claude-code-settings-local-json-secrets-docker-hub","source_urls":["https://blog.gitguardian.com/claude-code-settings-local-json-secrets-docker-hub"],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:claude-code-settings-local-json-secrets-17-months-9b923f","status":"published","visuals":[],"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"routes":{"html":"https://newruntime.com/posts/claude-code-settings-local-json-secrets-17-months-9b923f/","markdown":"https://newruntime.com/posts/claude-code-settings-local-json-secrets-17-months-9b923f.md","json":"https://newruntime.com/posts/claude-code-settings-local-json-secrets-17-months-9b923f.json"},"markdown_url":"https://newruntime.com/posts/claude-code-settings-local-json-secrets-17-months-9b923f.md","related_shifts":["delegated-agent-identity"],"next_reads":[{"type":"topic","path":"/topics/github/","url":"https://newruntime.com/topics/github/","title":"Github","reason":"Explore the github topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/github.md","json_url":"https://newruntime.com/topics/github.json"},{"type":"topic","path":"/topics/claude/","url":"https://newruntime.com/topics/claude/","title":"Claude","reason":"Explore the claude topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/claude.md","json_url":"https://newruntime.com/topics/claude.json"},{"type":"topic","path":"/topics/claude-code/","url":"https://newruntime.com/topics/claude-code/","title":"Claude Code","reason":"Explore the claude-code topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/claude-code.md","json_url":"https://newruntime.com/topics/claude-code.json"},{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/sources/","url":"https://newruntime.com/sources/","title":"Sources","reason":"See the original sources this archive cites.","media_type":"text/html"}]}