What happened
GitGuardian researcher Guillaume Valadon’s November 9, 2026 article reports a scan of public GitHub commits from January 2025 through November 7, 2026. The company found 31,088 distinct secrets in .claude/settings.local.json, across 23,276 repositories and 11,336 authors. Of those secrets, 5,343 were valid at detection. GitGuardian says its automated validity checks are read-only and that secrets without a detector capable of checking them are not counted as valid, making the valid total a floor rather than a complete measure.
The report describes how the file can acquire a credential. When Claude Code asks permission to run a shell command, selecting “Yes, and don’t ask again” saves an allow rule in the project’s settings.local.json. The rule is the command string itself. If the command includes an API key, password, or other credential, that value can be stored in the file. Claude Code excludes the file from Git on the user’s machine, but GitGuardian says this does not protect a file already tracked by Git, an older clone, or a copy committed through another workflow.
GitGuardian distinguishes its findings from Apiiro’s earlier analysis. Apiiro counted 1,379 secrets in current copies of the file plus 734 in history, using a conservative filter and without checking validity. GitGuardian continuously monitored public commits, including files later deleted, rewritten, or force-pushed away. Its report says 67% of occurrences in settings.local.json were valid where a validity check was available. The largest live credential group was database identifiers, with 2,280 distinct valid secrets; cloud-provider tokens accounted for 971 and AI tokens for 583.
The company also searched public Docker Hub images. It found 613 distinct secrets in .claude/settings.local.json files across images, 99 valid, and reported 109,284 occurrences across 543 image repositories and 7,625 tags. GitGuardian says 72% were under paths such as /app, /workspace, or /usr/src, consistent with copying a working tree into an image. A COPY . . instruction can include files excluded by Git unless .dockerignore excludes them too. One valid Cloudflare API token appeared in 559 tags of one image. The report says deleting a file from a repository does not remove copies from images already pushed.
What the archive adds
New Runtime’s earlier coverage on November 9, 2026 reported Apiiro’s finding of 2,539 real secrets across 1,994 public GitHub repositories, beyond 1,122 exposed Claude Code settings files: the earlier note. GitGuardian adds a continuous-commit view, validity checks, and a Docker Hub measurement. This is a new fact on a known story, not a restatement.
Trend signal
This strengthens the case that security depends on runtime and configuration boundaries, not just instructions to an agent. But the concrete exposure here comes from a persisted permission rule and build pipeline, not a newly demonstrated agent runtime exploit. This does not yet fit a pattern New Runtime tracks.
Why now
GitGuardian’s time series shows monthly leaks in settings.local.json rising to 12,535 occurrences in April 2026, then falling to 959 in October, a 92% drop from the peak. The company says it does not know what changed and lists possible explanations including permission or ignore-handling changes, adoption, GitHub push protection, or its own detection coverage. The timing makes the unresolved cause important: the decline alone does not establish that the exposure path has been fixed.
Why it matters
A local approval is often treated as a convenience setting, but this report shows how it can become a durable credential-bearing artifact. For teams, the security boundary extends beyond the agent’s prompt and repository: local configuration can enter Git history, forks, and container images. Removing the file does not undo those copies, and rotating credentials is therefore the first remediation step.
GitGuardian recommends rotating credentials found in the file, adding it to the repository’s .gitignore and .dockerignore, and removing secret-bearing rules through the file or Claude Code’s /permissions command. For future commands, it recommends environment-variable references rather than literal values and narrower command prefixes rather than broad approvals. Security teams should scan agent configuration and instruction files, histories, CI, and container registries, including for generic passwords embedded in command strings. These are useful controls, but the report does not establish how widely teams have adopted them or whether they prevent all relevant leaks.
Limits and uncertainty
GitGuardian’s results concern public GitHub commits and public Docker Hub images, not private repositories or registries. Its validity counts include only secrets its automated checks could verify; the company describes them as a floor. The monthly decline after April 2026 has no confirmed explanation, and GitGuardian says it has not finished ruling out changes in its own detector coverage. The report relays Anthropic’s statement that it is looking into the issue and prototyping auto mode and secret scanning; it does not establish when those changes will ship or whether they will prevent the exposures described.
Skill to build now
This week, audit one coding-agent repository end to end: check .claude/settings.local.json and Git history, add .claude/ to both .gitignore and .dockerignore, and search existing container images for copies. If a credential appears, revoke and replace it before cleanup; then update permission rules to use environment-variable names and narrow command prefixes. The sequence matters because removing a file cannot invalidate a credential already copied elsewhere.
Reader takeaway
Treat coding-agent settings as secret-bearing configuration, even when the tool ignores a file locally. A command approved for convenience can preserve the credential it contains, and Git or a container build can carry it beyond the machine. Rotate first, then remove copies and change the workflow that writes them.
Open question
What caused the sharp fall in reported monthly leaks after April 2026, and will Anthropic’s planned controls close the specific path GitGuardian measured?