[Claude Code Exposed for Writing Passwords into Settings Files; 2,539 Genuine Credentials Found on GitHub] According to Ars Technica, security firm Apiiro discovered that over 100,000 Claude Code local settings files were uploaded to public GitHub repositories. Approximately 1,100 of these files contained database passwords, API tokens, private keys, or root login information, involving 2,539 genuine credentials across 1,994 codebases and affecting 63 organizations. When users selected "Yes, and don't ask again," the original command text containing the keys may have been written to `.claude/settings.local.json` and subsequently mistakenly committed to the repository.