GitGuardian finds 31,088 secrets in coding agent settings on GitHub

GitGuardian finds 31,088 secrets in coding agent settings on GitHub

9 November 2026: GitGuardian, the secrets-detection company, says it found 31,088 distinct secrets in Claude Code's .claude/settings.local.json files on public GitHub, spread over 23,276 repositories and 11,336 authors, and that 5,343 of them were still valid when detected. A further 613 secrets, 99 of them valid, had reached public Docker Hub images.

How a key ends up in a file

The mechanism is a convenience feature. When the coding agent proposes a shell command, such as a curl call with an API key in a header, and the user answers "Yes, and don't ask again", the tool writes an allow rule into the project's settings file. That rule is the full command string, key included.

The file is meant to stay local and is often ignored globally on the developer's own machine. But it is not ignored at the repository level, so it gets committed from another machine, an older clone or a teammate's setup. GitGuardian counted another 8,271 secrets, 1,283 of them valid, in the shared settings.json file, which is meant to be committed.

Docker is the second route out. A COPY . . instruction copies the working tree, not the git index, so a file that never reached GitHub can still ship inside an image. GitGuardian found one valid Cloudflare API token in 559 image tags.

A peak in April, then a fall

The research covers January 2025 to 7 November 2026. Monthly leaks in settings.local.json peaked at 12,535 occurrences in April 2026 and fell to 959 by October, a drop of about 92%. GitGuardian says it does not yet know what changed.

Apiiro published its own analysis of the same file on 5 November. According to ain.ua's account, it found more than 100,000 copies of the file published and about 1,100 containing secrets from 63 organisations. The two companies counted differently, so their figures are not comparable; we could not open Apiiro's page.

Three things to do this week

• Rotate any key that was ever typed into a command the agent was allowed to run without asking, and check the provider's logs for its use.
• Add .claude/settings.local.json to the repository's own .gitignore, not only the global one, and to .dockerignore.
• Scan the repository history, not only the current tree, because a deleted file stays in earlier commits.

The underlying pattern is not specific to one tool: any agent that remembers approvals as literal command strings will store whatever secrets those commands contain. Teams that let coding agents call APIs can avoid the problem by passing keys through environment variables, so the approved command never contains them.

Sources

• GitGuardian: Claude Code settings.local.json secrets, 17 months of exposure on GitHub and Docker Hub, 9 November 2026, 9 November 2026
• ain.ua: passwords and API keys from Claude Code settings ended up in public GitHub repositories, 10 November 2026, 10 November 2026