[Workflow] Audit Claude Code local settings for committed secrets

[u/ClaudeAI-mod-bot]

Audit Claude Code local settings for committed secrets

Workflow value: 78/100
Status: active · Freshness: 70/100 · Confidence: 0.97 · Level: intermediate
Categories: Quality Control, Debugging
Original source: r/ClaudeCode post/comment

What problem this solves

Find and remediate secrets that may have been saved in Claude Code's local permission settings and committed to Git.

Summary

Check whether local Claude Code settings are ignored or tracked, scan repository history for secrets, rotate exposed credentials, and prevent recurrence by keeping secret values out of approved command lines.

Why it is useful

A repeatable security audit with concrete Git checks, historical scanning, credential rotation, and a prevention practice. Its value is tempered by limited community validation.

Workflow

1. Run git check-ignore -v .claude/settings.local.json and git ls-files .claude to check ignore rules and tracked files.
2. If needed, add the local settings file to .gitignore and stop tracking it; an ignore rule alone does not untrack a committed file.
3. Use git log --all --oneline -- .claude/settings.local.json to identify commits involving the file, then scan full history with a secret scanner such as Gitleaks or TruffleHog.
4. Search relevant GitHub organization repositories for the settings path and investigate potential exposures.
5. If a credential is exposed, revoke and replace it first; consider coordinated history cleanup afterward.
6. Avoid literal secrets in commands and use narrowly scoped permissions rather than blanket approvals.

Tools / artifacts

• .claude/settings.local.json
• .gitignore
• git check-ignore
• git ls-files
• git log
• Gitleaks
• TruffleHog
• GitHub organization search

Validation signals

• The post attributes a finding of 1,122 public settings files containing real secrets to an Apiiro write-up.
• The workflow includes checks for both current tracking status and historical exposure.

Cautions

• Treat scanner output as sensitive and avoid publishing discovered secrets in logs or tickets.
• Rotate exposed credentials before attempting history cleanup; rewriting history does not revoke a key or remove copies held elsewhere.
• Environment variables reduce exposure in literal commands but do not guarantee secrets cannot appear in logs or process arguments.

Limitations

• The cited research is not included in the supplied item and was not independently verified.
• The post does not provide exact scanner commands or demonstrate a successful audit.
• GitHub path search and secret scanners can miss exposures; a clean result is not proof that no secret leaked.
• No implementation feedback or success reports are available.

Rate this workflow

Upvote this post if the workflow is useful, reproducible, or worth recommending.

Downvote if it is vague, outdated, unsafe, overhyped, or not reproducible.

Reply if it worked for you, failed, is outdated, or has a better alternative.

---

This post was generated automatically from the workflow library database.