Claude Code: when approving a command creates another place to store secrets
Saved permissions can turn sensitive commands into configuration files. A review should follow each secret from the developer workstation through repository copies.
Ler em portuguêsBy Pentesty
What the research establishes
CISO Advisor’s November 8 report points to Apiiro’s research, published November 5 and updated November 8, with collection between November 1 and 3. Researchers found 1,122 public copies of .claude/settings.local.json containing values classified as secrets. Other study totals also include different artifacts and history, without demonstrating attacker use.
Apiiro did not test whether the collected credentials were valid; it reports that one organization confirmed a key had been live. The update includes a November 7 response from Anthropic’s Boris Cherny and potential improvements under consideration. This does not establish that a fix has shipped. Pentesty did not reproduce the survey or access third party credentials.
Approval also produces an artifact
The permissions documentation describes permanent Bash command approvals saved in .claude/settings.local.json for future sessions in the documented local project cases. Location exceptions apply, and other operations have different scopes. A rule containing a command with a literal password can create another copy of that value. Approving an action and reviewing what will be stored are separate decisions.
The word “local” describes a configuration scope, not a confidentiality guarantee. A team needs to know who can read the file and which processes copy it. In practice, we recommend including agent configurations in the development artifact inventory alongside logs, transcripts and diagnostic bundles.
The settings documentation describes a global Git exclusion when the client creates the file. The research describes limits of Git’s global exclusion: it does not travel with the project or untrack existing files. An entry in the repository’s .gitignore helps prevent new additions, but neither revokes a key nor removes previous copies. Controls need to address the current index and history.
After exposure, follow the access that was granted
In a real case, the issuing service’s owner should revoke or rotate the exposed access and verify its replacement. Preserve evidence under restricted access and examine service records to establish observed use. Presence on GitHub alone does not prove exploitation; the absence of an alert does not establish that nobody accessed the credential.
Untrack the file and coordinate cleanup of history, forks and mirrors controlled by the organization. Do not promise to erase copies that third parties may already hold. Prefer secret manager references to literal values and check that logs and configuration files remain free of those values.
Our analysis of secrets and history in GitHub automation helps organize revocation. Our review of AI agent action boundaries addresses who authorizes each operation. These are distinct events, but the same team can use the checks to follow where an approval leaves data and authority.
Frequently asked questions
Does every use of Claude Code expose credentials?
No. The described risk depends on saved content and who can access or publish the artifacts. Testing must reproduce the organization’s authorized workflow.
Does adding the file to .gitignore resolve a previous exposure?
No. Review tracking and earlier copies, but first address access validity in the service that issued the credential.
Do the numbers demonstrate thousands of intrusions?
No. They are findings attributed to research on public artifacts. Confirming misuse requires additional evidence from the affected environment.
What evidence supports closing remediation?
Record rejection of the revoked credential, operation of its replacement with minimum scope and a repeated version control test without exposing values.
Sources and references
- CISO Advisor: November 8 editorial reference
- Apiiro: research and November 8 update
- Claude Code: saved permissions
- Claude Code: configuration file scopes
Original Pentesty analysis, published November 8, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.