---
type: "post"
id: "claude-code-settings-local-json-secrets-17-months-9b923f"
slug: "claude-code-settings-local-json-secrets-17-months-9b923f"
title: "Claude Code settings.local.json Secrets: 17 months of exposure on GitHub, & Docker Hub"
description: "GitGuardian says it found 31,088 distinct secrets in Claude Code’s project-level settings.local.json files across 23,276 public GitHub repositories, with 5,343 still valid when detected."
retrieval_nugget: "GitGuardian says it found 31,088 distinct secrets in Claude Code’s project-level settings.local.json files across 23,276 public GitHub repositories, with 5,343 still valid when detected. The report also found secrets in Docker Hub images. The mechanism matters to teams using coding agents: approving a command for repeated use can persist its literal credentials in a project file."
published_at: "2026-11-11"
updated_at: "2026-11-11"
record_date: "2026-11-11"
date_kind: "published_at"
topics: ["github","claude","claude-code"]
entities: ["GitGuardian","Claude Code","Anthropic","Apiiro","Docker Hub","GitHub"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "GitGuardian counted 31,088 secrets across 23,276 public GitHub repositories, including 5,343 valid credentials, and found 613 secrets in Docker Hub images, 99 still valid."
prior_refs: ["https://newruntime.com/posts/clicking-yes-and-don-t-ask-again-in-852ac3/"]
source_url: "https://blog.gitguardian.com/claude-code-settings-local-json-secrets-docker-hub"
source_urls: ["https://blog.gitguardian.com/claude-code-settings-local-json-secrets-docker-hub"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:claude-code-settings-local-json-secrets-17-months-9b923f"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/claude-code-settings-local-json-secrets-17-months-9b923f/","markdown":"https://newruntime.com/posts/claude-code-settings-local-json-secrets-17-months-9b923f.md","json":"https://newruntime.com/posts/claude-code-settings-local-json-secrets-17-months-9b923f.json"}
markdown_url: "https://newruntime.com/posts/claude-code-settings-local-json-secrets-17-months-9b923f.md"
related_shifts: ["delegated-agent-identity"]
---

# Claude Code settings.local.json Secrets: 17 months of exposure on GitHub, & Docker Hub

## Retrieval answer

GitGuardian says it found 31,088 distinct secrets in Claude Code’s project-level settings.local.json files across 23,276 public GitHub repositories, with 5,343 still valid when detected. The report also found secrets in Docker Hub images. The mechanism matters to teams using coding agents: approving a command for repeated use can persist its literal credentials in a project file.

## Summary

GitGuardian says it found 31,088 distinct secrets in Claude Code’s project-level `settings.local.json` files across 23,276 public GitHub repositories, with 5,343 still valid when detected. The report also found secrets in Docker Hub images. The mechanism matters to teams using coding agents: approving a command for repeated use can persist its literal credentials in a project file.

## What happened

GitGuardian researcher Guillaume Valadon’s November 9, 2026 article reports a scan of public GitHub commits from January 2025 through November 7, 2026. The company found 31,088 distinct secrets in `.claude/settings.local.json`, across 23,276 repositories and 11,336 authors. Of those secrets, 5,343 were valid at detection. GitGuardian says its automated validity checks are read-only and that secrets without a detector capable of checking them are not counted as valid, making the valid total a floor rather than a complete measure.

The report describes how the file can acquire a credential. When Claude Code asks permission to run a shell command, selecting “Yes, and don’t ask again” saves an allow rule in the project’s `settings.local.json`. The rule is the command string itself. If the command includes an API key, password, or other credential, that value can be stored in the file. Claude Code excludes the file from Git on the user’s machine, but GitGuardian says this does not protect a file already tracked by Git, an older clone, or a copy committed through another workflow.

GitGuardian distinguishes its findings from Apiiro’s earlier analysis. Apiiro counted 1,379 secrets in current copies of the file plus 734 in history, using a conservative filter and without checking validity. GitGuardian continuously monitored public commits, including files later deleted, rewritten, or force-pushed away. Its report says 67% of occurrences in `settings.local.json` were valid where a validity check was available. The largest live credential group was database identifiers, with 2,280 distinct valid secrets; cloud-provider tokens accounted for 971 and AI tokens for 583.

The company also searched public Docker Hub images. It found 613 distinct secrets in `.claude/settings.local.json` files across images, 99 valid, and reported 109,284 occurrences across 543 image repositories and 7,625 tags. GitGuardian says 72% were under paths such as `/app`, `/workspace`, or `/usr/src`, consistent with copying a working tree into an image. A `COPY . .` instruction can include files excluded by Git unless `.dockerignore` excludes them too. One valid Cloudflare API token appeared in 559 tags of one image. The report says deleting a file from a repository does not remove copies from images already pushed.

## What the archive adds

New Runtime’s earlier coverage on November 9, 2026 reported Apiiro’s finding of 2,539 real secrets across 1,994 public GitHub repositories, beyond 1,122 exposed Claude Code settings files: [the earlier note](https://newruntime.com/posts/clicking-yes-and-don-t-ask-again-in-852ac3/). GitGuardian adds a continuous-commit view, validity checks, and a Docker Hub measurement. This is a new fact on a known story, not a restatement.

## Trend signal

This strengthens the case that security depends on runtime and configuration boundaries, not just instructions to an agent. But the concrete exposure here comes from a persisted permission rule and build pipeline, not a newly demonstrated agent runtime exploit. This does not yet fit a pattern New Runtime tracks.

## Why now

GitGuardian’s time series shows monthly leaks in `settings.local.json` rising to 12,535 occurrences in April 2026, then falling to 959 in October, a 92% drop from the peak. The company says it does not know what changed and lists possible explanations including permission or ignore-handling changes, adoption, GitHub push protection, or its own detection coverage. The timing makes the unresolved cause important: the decline alone does not establish that the exposure path has been fixed.

## Why it matters

A local approval is often treated as a convenience setting, but this report shows how it can become a durable credential-bearing artifact. For teams, the security boundary extends beyond the agent’s prompt and repository: local configuration can enter Git history, forks, and container images. Removing the file does not undo those copies, and rotating credentials is therefore the first remediation step.

GitGuardian recommends rotating credentials found in the file, adding it to the repository’s `.gitignore` and `.dockerignore`, and removing secret-bearing rules through the file or Claude Code’s `/permissions` command. For future commands, it recommends environment-variable references rather than literal values and narrower command prefixes rather than broad approvals. Security teams should scan agent configuration and instruction files, histories, CI, and container registries, including for generic passwords embedded in command strings. These are useful controls, but the report does not establish how widely teams have adopted them or whether they prevent all relevant leaks.

## Limits and uncertainty

GitGuardian’s results concern public GitHub commits and public Docker Hub images, not private repositories or registries. Its validity counts include only secrets its automated checks could verify; the company describes them as a floor. The monthly decline after April 2026 has no confirmed explanation, and GitGuardian says it has not finished ruling out changes in its own detector coverage. The report relays Anthropic’s statement that it is looking into the issue and prototyping auto mode and secret scanning; it does not establish when those changes will ship or whether they will prevent the exposures described.

## Skill to build now

This week, audit one coding-agent repository end to end: check `.claude/settings.local.json` and Git history, add `.claude/` to both `.gitignore` and `.dockerignore`, and search existing container images for copies. If a credential appears, revoke and replace it before cleanup; then update permission rules to use environment-variable names and narrow command prefixes. The sequence matters because removing a file cannot invalidate a credential already copied elsewhere.

## Reader takeaway

Treat coding-agent settings as secret-bearing configuration, even when the tool ignores a file locally. A command approved for convenience can preserve the credential it contains, and Git or a container build can carry it beyond the machine. Rotate first, then remove copies and change the workflow that writes them.

## Open question

What caused the sharp fall in reported monthly leaks after April 2026, and will Anthropic’s planned controls close the specific path GitGuardian measured?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Github](https://newruntime.com/topics/github.md): Explore the github topic hub.
- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- topic hub: [Claude Code](https://newruntime.com/topics/claude-code.md): Explore the claude-code topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)