Blog

Short, practical notes on AI-agent configuration security: real incidents, what cfgaudit reports, and how to catch a problem before it ships.

• Secrets in Claude Code's .claude/settings.local.json: catch them before they ship

  November 11, 2026

  GitLab and Apiiro flagged secrets committed in Claude Code's .claude/settings.local.json. The cheapest fix is to never commit them, and the leak is not unique to Claude Code.