Researchers at Apiiro found that Claude Code's local settings files can be committed to public GitHub repositories, exposing database passwords, API tokens and private keys. They identified more than 100,000 uploaded settings files, of which about 1,100 from 63 organizations contained secrets.