After the Claude Code settings leak, I went through my own agent setups. Here’s the routine I landed on. Nothing in it is specific to any one machine.
- Ignore per-project: add
.claude/settings.local.json(and any other local agent state) to each repo’s.gitignore, not just your global excludes, so the rule travels with the repo. - Check history:
git log --all --oneline -- .claude/shows whether it was ever committed. - Scan: run gitleaks and TruffleHog, then grep agent files by hand. Neither tool caught everything in the research.
- Rotate before rewriting: if a secret ever landed in git, rotate it first. Rewriting history doesn’t help forks or clones.
- No secrets on the command line: load them from env files or a secrets manager so the approved command never has the value in it.
- Prefer patterns: approve rules like
npm test *instead of one-off commands with tokens in them.
God Bless, and Happy hacking!
