Claude Code approval files found exposing company secrets on GitHub, says Apirro researchers

Detailed summary

Apiiro researchers say remembered commands are carrying credentials into public repositories, exposing a gap between approving an agent’s work and controlling what it leaves...

Apiiro researchers say remembered commands are carrying credentials into public repositories, exposing a gap between approving an agent’s work and controlling what it leaves behind.

You ask your AI coding assistant to check a database connection. It proposes a command, asks permission, and offers to stop interrupting you for that command in future. You approve it and get on with your work.

What you may not realise is that the approval itself can become another copy of your database password.

That is the problem examined in research published on 5 November by Apiiro’s Shmulik Cohen and Matan Giladi. They say Claude Code can retain a complete approved shell command, including credentials, in .claude/settings.local.json. If that file is committed and pushed to a public repository, the credentials go with it.

Opening of the article, excerpted from iTWire. To read the rest, open the article on the publisher's site.