Skip to content
Threat Feed
Subscribe
high advisory

Anthropic Claude Code: Sensitive credential exposure in settings files

Anthropic Claude Code incorrectly persists sensitive command strings containing secrets into local settings files, which are frequently committed to public version control due to configuration oversights.

Triage facts

Revision 2
Applicability
Claude Code, LibreOffice
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 2Nov 9, 18:36 UTC
Source quality
B2Roughly even chance
Revision history 1 entry · Revision 2
  1. Revision 2

    added coverage for Claude Code +1 products

    Changed: action_plan, affected_os, affected_products, lastmod, references, tags, ttps, updates

    Sources: 1

Claude Code stores user-approved automated shell commands in a local '.claude/settings.local.json' file when the "Yes, and don't ask again" option is selected. These entries often include raw command strings containing sensitive information such as database passwords, API tokens, and root credentials. While Anthropic documentation suggests this file is included in global '.gitignore' lists, it is frequently absent from repo-level configurations, leading to the accidental exposure of these credentials in public GitHub repositories.

Impact

Researchers identified over 100,000 instances of this file in public repositories, with at least 1,100 files across 63 organizations confirmed to contain high-value secrets. These secrets remain accessible via project forks even after the primary repository is cleaned.

Recommendation

  • Implement secret scanning (e.g., Gitleaks, TruffleHog) on all internal and public-facing Git repositories, specifically targeting '.claude/settings.local.json' files.
  • Audit existing public and internal Git repositories for the presence of the '.claude/' directory.
  • Manually configure global '.gitignore' files across all developer workstations to include '.claude/settings.local.json'.
  • Revoke and rotate any credentials discovered in exposed '.claude/' settings files.

Immediate actions

Scan all enterprise-managed Git repositories for the presence of .claude/settings.local.json files.

SOC 24h

Perform an inventory of all active AI skills and add-ons running in Linux-based developer environments.

SOC 48h

Threat Hunt

Identify commits containing .claude/settings.local.json in version control metadata.

T1552.001 high high confidence hunt now

Data: Git commit history logs, GitHub organization repository search results

Identify file writes to system temporary directories (e.g., /tmp, /var/tmp) involving .so files created by processes associated with AI agent document processing.

T1574.006 high medium confidence hunt now

Data: Auditd file_event or EDR process_creation/file_write telemetry

Mitigations

Rotate all credentials potentially exposed in .claude/settings.local.json files.

immediate IT Operations

Credential compromise

Apply strict file system permissions on temporary directories used by AI agent helper scripts to limit write access.

medium IT Operations

Office Party vulnerability