Claude Code settings.local.json: How Approved Commands Leak Secrets

The approval rule stores the whole command, and the file that keeps it out of git lives on one laptop