Last checked . Picks are based on the prices, rates, fees and terms each provider publishes, checked at the source. We never rank products by commission. See how we’re funded.
When Claude Code asks to run a shell command and a developer picks “Yes, and don’t ask again,” the approval is saved in a file called settings.local.json. Anthropic’s settings documentation says the file lives inside the project’s .claude folder and stores the approval as an allow rule. If the command that was approved contained a password or token, that secret sits in the file in plain text. Security researchers have found such files in public code repositories and npm packages. This guide covers what settings.local.json holds, whether Git ignores it, how to check a project, and what to do if a secret has already left the machine.
What settings.local.json holds
Anthropic describes settings.local.json as the project-local settings file, meant for one person’s overrides in one project. Claude Code writes to it as well. Each time a developer chooses “Yes, and don’t ask again” on a Bash command, Claude Code saves that approval as an allow rule in the file. Because the rule is built from the command, any value typed directly into the command goes along with it.
The documentation also says where the file sits. If Claude Code starts in a subdirectory of a Git repository, it reads and writes settings.local.json at the repository root, and worktrees use the file at the main checkout’s root. Outside a Git repository, when the repository root is the home directory, or on Windows, the file stays next to .claude/settings.json instead.
The shared sibling, .claude/settings.json, is meant for the opposite purpose. Anthropic says to commit it so everyone who clones the repository gets the same permissions, hooks and plugins. That difference matters here: a rule moved from the local file into the shared one, by hand or by copy and paste, is then published with the repository on purpose.
What researchers have found
Two write-ups describe leaks from this file. The first, by Niels Hofmans of ironPeak, is dated Feb. 17, 2026. He says his own leak was a settings.local.json holding approved commands with secrets passed as environment variables, and that a scan of public GitHub repositories found verified API keys and database credentials. The second is Check Point Software research reported by IT Brief on April 23, 2026.
| Item | Check Point finding, as reported by IT Brief |
|---|---|
| Where it looked | New and updated packages on the public npm registry |
| Packages monitored | About 46,500 |
| Packages containing settings.local.json | 428 |
| Files with credentials | 33 files across 30 packages |
| Secrets seen | npm and GitHub tokens, Telegram bot tokens, Hugging Face tokens, production bearer tokens and test logins |
IT Brief says the file reached npm because the .claude directory was inside the package folder and nothing excluded it. The article does not mention a response from Anthropic.
Does Git ignore settings.local.json?
Usually, according to Anthropic. The documentation says the first time Claude Code writes settings.local.json in a Git repository that does not already ignore it, Claude Code adds **/.claude/settings.local.json to the global Git excludes file. That is the file set by core.excludesFile in the global Git config, or $XDG_CONFIG_HOME/git/ignore, or ~/.config/git/ignore when that variable is not set. Anthropic adds that anyone who created the file by hand should add it to .gitignore directly. The documentation also says the file’s allow rules apply without the workspace trust step only while the file stays untracked, so a settings.local.json that Git tracks is treated more like a committed file.
A global Git exclude covers Git commits. It does not cover every route a folder can take, and the npm findings above are the example. The docs do not say which Claude Code versions began adding the exclude, so a project touched by an older install may behave differently.
How to check a project for saved secrets
The steps below are the Jolt Journal’s own suggestions built on standard Git and npm commands, not Anthropic’s instructions. Run them from the repository root.
- Open
.claude/settings.local.jsonand read every allow rule. Look for passwords, API keys, bearer tokens, connection strings and anything written asNAME=valueinside a command. - Run
git check-ignore -v .claude/settings.local.json. If Git prints a rule, the file is ignored. If it prints nothing, it is not. - Run
git ls-files .claudeto see whether any file in the folder is tracked by Git. - Run
git log --all --oneline -- .claude/settings.local.jsonto see whether the file was ever committed, even if it was deleted later. - For a package, run
npm pack --dry-runand read the file list for a.claudeentry before publishing.
Check Point’s advice, as reported, is to add .claude to .npmignore, check the files field in package.json if the project uses one, and review versions already published while Claude Code was in use.
If a secret has already left the machine
Both write-ups give the same first instruction: treat any exposed credential as compromised and replace it. Check Point says that includes npm and GitHub tokens found in a published package. Removing a file from the latest commit is not enough, because it remains in Git history. ironPeak recommends rewriting history with git-filter-repo or BFG Repo-Cleaner after the keys have been rotated, and scanning with TruffleHog or gitleaks. It also suggests a global gitignore, a pre-commit hook that blocks commits containing AI tool folders, and a secret scanner in CI.
The simplest prevention is to keep secrets out of approved commands. A command that reads a value from an environment variable or a secrets manager leaves nothing to leak in settings.local.json, and that is a Jolt Journal suggestion, not an Anthropic rule. Readers who want more background on threats aimed at developer tools can read the Jolt Journal’s reports on the fake Claude Code extension and on fake ChatGPT and Claude desktop apps.
What the sources leave open
The ironPeak post does not say clearly whether its 2.4% figure refers to the 100 repositories it mentions or to a larger set, so that number is left out of this guide. IT Brief’s article gives no Anthropic response, and Anthropic’s documentation does not say when the global exclude behavior began. None of the three sources shows how many of the exposed credentials were still valid when they were found.
Editor’s take
The setting that causes this problem is a convenience: one click so Claude Code stops asking. The file it writes is personal and normally ignored by Git, which makes the leaks easy to miss. Five minutes with the commands above is cheaper than rotating a production token, and the habit worth keeping is simple: never let a secret appear in a command that gets saved.
This is general security information. Anthropic’s documentation has the final word on how Claude Code stores settings.
