GitGuardian identified thousands of live credentials embedded in locally stored Claude Code permission rules later copied into public Git and Docker artifacts. Entry and authority. A developer approves a command embedding an actual credential, and an assistant persists the literal command in settings.local.json. That settings file later reaches a public…
Inspect the ClaimsCase · DiggingBeagle record
Claude Code saved approval commands exposed secrets in repositories and images
GitGuardian identified thousands of live credentials embedded in locally stored Claude Code permission rules later copied into public Git and Docker artifacts.
Public disclosure: Nov 9, 2026
Scope
A developer approves a command embedding an actual credential, and an assistant persists the literal command in settings.local.json. That settings file later reaches a public repository/history or container image. A supposed future authorization shortcut became a persistent record of the secret; source control ignoring the file did not protect copied history or Docker layers.
Assessment profile
Assessment method- Setting
- controlled live
- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GITGUARDIAN-CLAUDE; reviewed as research in controlled_live. Evidence of reported deployed or live observations does not alone establish complete victim losses or actor attribution. The source does not establish an unauthorized effect in a real deployment.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-GITGUARDIAN-CLAUDE-01 · CLM-DB233-GITGUARDIAN-CLAUDE-02 · GitGuardian: Claude Code settings secrets in GitHub and Docker Hub
At a glance
Counts describe scanner-observed secret artifacts and validity tests, not verified human-account takeovers or all affected deployments.
Limits and uncertaintyFull account
GitGuardian identified thousands of live credentials embedded in locally stored Claude Code permission rules later copied into public Git and Docker artifacts.
Entry and authority. A developer approves a command embedding an actual credential, and an assistant persists the literal command in settings.local.json. That settings file later reaches a public repository/history or container image.
Observed mechanism and consequence. A supposed future authorization shortcut became a persistent record of the secret; source control ignoring the file did not protect copied history or Docker layers.
Limits and status. Counts describe scanner-observed secret artifacts and validity tests, not verified human-account takeovers or all affected deployments.
GitGuardian's study found secrets embedded in published Claude Code local approval settings, including repositories and container images. Values stored in configuration or command arguments can survive as durable artifacts and be redistributed by source control or image registries, although the initial approvals were meant to govern local agent behavior. A scanner-confirmed still-valid key is evidence of exposure; it does not by itself prove the key was abused.
Mechanism and trust boundary
- 01
Precondition and trust context
A developer approves a command embedding an actual credential, and an assistant persists the literal command in settings.local.json. That settings file later reaches a public repository/history or container image.
- 02
Crossed boundary
A supposed future authorization shortcut became a persistent record of the secret; source control ignoring the file did not protect copied history or Docker layers.
- 03
Observed limit
Counts describe scanner-observed secret artifacts and validity tests, not verified human-account takeovers or all affected deployments.
Timeline
- Nov 9, 2026Event type unspecified
Initial documented finding
Claude Code saved approval commands exposed secrets in repositories and images
- Nov 9, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-GITGUARDIAN-CLAUDE-01GitGuardian reported 31,088 distinct secrets across 23,276 repositories and 5,343 that were valid when detected.supported
Basis: reported finding
- supportsGitGuardian: Claude Code settings secrets in GitHub and Docker Hubindependent technical reproduction
TL;DR: 31,088 secrets, 5,343 valid
CLM-DB233-GITGUARDIAN-CLAUDE-02The same investigation identified 613 secrets in public Docker Hub images and 99 valid at detection.supported
Basis: reported finding
- supportsGitGuardian: Claude Code settings secrets in GitHub and Docker Hubindependent technical reproduction
TL;DR and Docker Hub findings
Controls and mitigations
- Keep local agent approval and environment configuration outside published repositories and build contexts; remove literal secrets from scripts and settings.
- Rotate any exposed credentials, scan repository history and published images, and restrict CI access to sensitive local configurations.
Unknowns and contradictions
- Counts describe scanner-observed secret artifacts and validity tests, not verified human-account takeovers or all affected deployments.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235