Claude Code Settings Files Expose Sensitive Information on GitHub

AI security researchers at Apiiro discovered that Claude Code is leaking sensitive information, including database passwords and API tokens, through its settings files on public GitHub repositories. Over 100,000 instances of these settings files were found uploaded, with approximately 1,100 containing sensitive secrets from 63 organizations. The issue arises from how Claude Code handles user approvals for automated commands and the lack of proper .gitignore implementation at the repository level.