What's Happening?
GitLab has issued guidance and tools to help users prevent, detect, and remediate a security vulnerability related to Anthropic's Claude Code AI assistant. The issue arises when developers use the 'Yes, and don’t ask again' option in Claude Code, which
saves shell commands, including those containing sensitive information like passwords or tokens, into a file named `.claude/settings.local.json`. This file is intended to be excluded from Git by the developer's personal global excludes, but this protection does not travel with the repository. Consequently, the file, potentially containing secrets, can be inadvertently committed and pushed to repositories. Apiiro reported in early November 2026 that this led to over 104,000 instances of the file in public repositories, with 1,122 containing at least one secret, and hundreds more found in historical commits. GitLab's guidance details how to implement preventative measures, assess current and past exposure, and clean up affected projects.
Why It's Important?
This vulnerability poses a significant risk to organizations utilizing Claude Code with GitLab repositories, as it can lead to the exposure of critical credentials and sensitive data. The inadvertent commitment of `.claude/settings.local.json` files containing secrets can compromise system security, potentially leading to unauthorized access, data breaches, and operational disruptions. For businesses, this means increased risk of financial loss, reputational damage, and regulatory penalties. The issue highlights a critical gap in how AI development tools manage sensitive information and integrate with version control systems. It underscores the need for robust security practices, including diligent configuration management, secret detection, and continuous monitoring within development pipelines to prevent such leaks. The incident also emphasizes the shared responsibility between AI tool developers and users in maintaining a secure software development lifecycle.
What's Next?
GitLab recommends immediate action for users of Claude Code. The first step is to implement preventative measures, including adding `.claude/settings.local.json` to `.gitignore` files, configuring push rules to block the file by name, enabling Secret Push Protection for token formats, and setting up scan execution policies to run GitLab Secret Detection across all projects. Following prevention, users should assess their repositories for existing or historical instances of the file using GitLab Duo Agentic Chat, code search, or the commits API. Any discovered secrets must be rotated immediately at their providers. GitLab Duo can then assist in creating merge requests to remove the file and update `.gitignore` across affected projects. Finally, historical data containing secrets should be purged from repository history. These steps aim to mitigate immediate risks and establish a more secure development environment.
Beyond the Headlines
This incident reveals deeper implications regarding the security posture of AI-assisted development workflows. The reliance on client-side exclusions for sensitive files, rather than robust, repository-level controls, demonstrates a potential blind spot in the design of some AI coding tools. It highlights the need for AI development environments to inherently integrate with and respect version control best practices, particularly concerning secret management. The vulnerability also underscores the human element in security; even with advanced tools, developer awareness and adherence to security protocols remain crucial. Long-term, this event could drive a shift towards more secure-by-design principles in AI development tools, prompting vendors to implement stronger default security configurations and better integration with enterprise security policies. It also emphasizes the growing complexity of securing the software supply chain, where vulnerabilities can originate from unexpected interactions between different development tools.
