Claude Code is accidentally exposing secrets all over GitHub
Summary
Ars Technica reports that Claude Code can leak sensitive data via its local settings file, with Apiiro finding thousands of secrets in public GitHub repositories. The root cause involves how the auto-approval prompts are stored in the .claude/settings.local.json file and how repo-level GitIgnore handling may fail to protect files. The piece also covers recommended mitigations like secret scanners, auto mode improvements, and developer caution.