Preventing Secret Leaks from Claude Code's Local Settings File
A guide to identifying and removing sensitive tokens inadvertently committed to GitLab repositories.
1Claude Code Secret Exposure
Claude Code, an AI coding agent, saves shell commands to a local file named .claude/settings.local.json. If a developer selects 'Don't ask again' for a command containing sensitive tokens or passwords, these secrets are saved in plain text. This file is often inadvertently committed to repositories, creating significant security vulnerabilities for organizations.
2Scope of the Problem
In early November 2026, research indicated that over 100,000 copies of this configuration file appeared in public repositories. Specifically, 1,122 of these files contained at least one active secret. Many additional secrets remained hidden within the commit history of deleted files, posing a persistent risk to affected development teams and projects.
3Preventing Future Commits
To prevent future leaks, administrators should add .claude/settings.local.json to the project's .gitignore file. For Premium and Ultimate users, enforcing a push rule that prohibits this specific filename is highly effective. These rules reject any push containing the file, ensuring that developers cannot accidentally upload their local configuration settings to the central repository.
4Secret Push Protection
Secret Push Protection acts as a secondary layer of defense by scanning the content of every push for known token formats. On GitLab.com, this feature is enabled by default. For self-managed instances, administrators must activate it within the security settings to ensure that sensitive credentials are blocked before they reach the server.
5Automated Security Policies
Group-level scan execution policies allow administrators to run GitLab Secret Detection across all projects. By configuring a weekly schedule with the SECRET_DETECTION_HISTORIC_SCAN variable, teams can audit their entire commit history. This ensures that even legacy projects or those without active pipelines are scanned for leaked tokens and sensitive configuration files.
6Assessing Exposure via Duo
GitLab Duo Agentic Chat provides the fastest method to audit repositories for the presence of the problematic file. By querying the group, the agent identifies current files, deleted versions, and specific commit history. This tool covers all subgroups and forks, providing a comprehensive table of affected projects and the nature of the exposure.
7Manual Search Methods
For teams without GitLab Duo, code search using regular expressions is the primary alternative. By searching for the specific file path in the code scope, administrators can locate current copies. It is essential to include archived projects in the search and use the API to iterate through all group projects to ensure complete coverage.
8Checking Commit History
Because search tools only show the current state of the default branch, checking the commit history is vital. Using the commits API with the follow=false parameter allows users to identify if the file ever existed in the repository. This method is effective across all GitLab tiers and successfully detects files hidden in past commits.
9Mitigation Strategy Order
The remediation process must follow a strict order: rotate, remove, and purge. First, rotate all compromised secrets at the provider level, as the data is considered public once committed. Only after rotation should developers remove the file from the repository and purge the sensitive blobs from the project's historical data to ensure security.
10Automating Cleanup Tasks
GitLab Duo can automate the removal process by opening merge requests across an entire group. The agent prepares commits that delete the file and update the .gitignore, requiring only two approval clicks from the administrator. This significantly reduces the manual effort required to clean up hundreds of projects simultaneously after a security incident.
11Purging Repository History
After removing the file, the sensitive content remains in the repository's internal object storage. Administrators must use the 'Remove blobs' feature in repository maintenance to permanently delete these versions. Following this, running housekeeping and pruning unreachable objects is necessary to ensure the secrets are completely scrubbed from the project's underlying data structure.
12Summary of Security Actions
Securing repositories against Claude Code leaks requires a combination of automated detection and strict policy enforcement. By utilizing GitLab Duo for assessment and cleanup, alongside push rules and scan policies, organizations can effectively mitigate risks. Regular audits and proactive configuration management are essential to maintaining a secure development environment for all teams.
Original article: GitLab — Preventing Secret Leaks from Claude Code's Local Settings File