Pranav Innovates

You commented LEAK. Here’s everything from the reel.

Is your Claude Code settings file leaking passwords? Check it in 2 minutes

From @PranavInnovates (the "Comment LEAK" reel, Nov 2026). When you pick "Yes, and don't ask again" in Claude Code, it saves the whole command as an allow rule in .claude/settings.local.json. If you typed a password or key into that command, it's saved there in plain text. GitGuardian found 31,088 distinct secrets in public copies of that file on GitHub (23,276 repos, 11,336 authors, Jan 2025 to Nov 2026), and 5,343 still worked when found. Source: blog.gitguardian.com/claude-code-settings-local-json-secrets-docker-hub (9 Nov 2026).

Is the file in your repo?

Run these in each project:

Terminal
git ls-files | grep -E '\.claude/settings(\.local)?\.json'          # tracked right now?
git log --all --oneline -- .claude/settings.local.json              # was it ever committed?

Claude Code tells git to ignore settings.local.json (it adds **/.claude/settings.local.json to your global git ignore file). In my test, git refused to add it until I used git add -f. A git add -f, a different machine without that global ignore, or a Docker image can still leak it. Docker doesn't read .gitignore.

Is there a secret in it?

A rough check that flagged all 10 of my planted secrets (and none of the clean rules). It's a starting point, not a guarantee:

Terminal
grep -nE 'PASSWORD=|PGPASSWORD|mysql[^)]* -p[^ ]|sshpass|://[^:@/ ]+:[^@/ ]+@|-u [^ ]+:|api-key|[Bb]earer|/bot[0-9]+:|_KEY=|TOKEN=|SECRET' \
  .claude/settings*.json

Inside Claude Code, /permissions lists every saved rule, so you can delete the ones with secrets in them.

Five free scannerswhat each one is for

Their scores come from one test: 10 fake secrets in a throwaway repo's .claude/settings.local.json, written the way Claude Code saves rules (one per leak pattern GitGuardian lists). Each tool ran once with its default rules, offline.

Scanner What it does for you Reach for it when Caught
TruffleHog Knows 800+ secret types and scans Git, chats, wikis, logs and buckets; can log in to check if a found key is still live You want one sweep of everything, plus "is this one live?" 5/10
Kingfisher (MongoDB) Finds secrets, checks which are still active, maps what a key can reach, and can revoke some You've found a leak and need to know how bad it is 4/10
gitleaks One fast binary for a pre-commit hook or a GitHub Action You want a simple gate on every commit and every PR 2/10 (5/5 lines in a plain .env)
detect-secrets (Yelp) Records the secrets already in a big repo in a .secrets.baseline and blocks new ones An old repo you can't clean up today 2/10
git-secrets (AWS) Installs git hooks that reject a commit containing a banned pattern You mostly worry about AWS keys 1/10 (AWS patterns only, out of the box)

Commands I ran: trufflehog git file://. --no-verification · kingfisher scan . --no-validate · gitleaks git . · detect-secrets scan --all-files . · git secrets --scan-history (and its hook, which blocked git commit).

  • All five together caught 6 of 10. Every scanner missed a Telegram bot token, PGPASSWORD=… psql, mysql -p… and sshpass -p ….
  • TruffleHog + Kingfisher together caught all 6 that any of them found.
  • The same fake API keys in a plain .env file: gitleaks flagged all 5 lines. The keys are only hard to see once they're inside quoted command strings in this JSON file.
  • One repo, 10 hand-made examples, default rules: not a general benchmark. Every tool can take custom rules.

The fix

  1. Keep passwords out of commands. Put them in environment variables (export PGPASSWORD=… in your shell or an untracked .env) and let the tool read them. Then the saved rule is just Bash(psql -h … -U admin shop).
  2. Never commit the file. Add both lines to .gitignore and .dockerignore:
    Prompt
    .claude/settings.local.json
    If it's already tracked: git rm --cached .claude/settings.local.json and commit.
  3. Already pushed? Rotate every credential it ever held. Deleting the file or rewriting history isn't enough: forks, clones and images keep copies.
  4. Prefer narrow rules such as Bash(npm test:*) over broad ones like Bash(curl:*), and approve once rather than "don't ask again" for anything with a secret in it.

Scan before you push (pre-commit)

With pre-commit (pre-commit.com), a .pre-commit-config.yaml like this runs TruffleHog and Kingfisher on each commit (both exit non-zero when they find something, which blocks the commit; tested on my planted repo):

yaml
repos:
  - repo: local
    hooks:
      - id: trufflehog
        name: TruffleHog
        entry: bash -c 'trufflehog filesystem . --no-verification --fail'
        language: system
        stages: ["pre-commit", "pre-push"]
      - id: kingfisher
        name: Kingfisher
        entry: bash -c 'kingfisher scan . --no-validate'
        language: system
        stages: ["pre-commit"]

Installs: brew install trufflehog kingfisher gitleaks (or the release binaries on GitHub). Remember the scanners missed the plain passwords in my test, so add the grep from step 2 too.

Links: TruffleHog github.com/trufflesecurity/trufflehog · Kingfisher github.com/mongodb/kingfisher · gitleaks github.com/gitleaks/gitleaks · detect-secrets github.com/Yelp/detect-secrets · git-secrets github.com/awslabs/git-secrets · Claude Code settings docs code.claude.com/docs/en/settings. Not sponsored.