Claude Code Leaks Developer Secrets in Public GitHub Repositories

A study by Apiiro researchers has revealed that Claude Code, Anthropic's coding assistant, can save passwords, API keys, and SSH tokens in plain text when a user selects the "Yes, and don't ask again" option while approving commands. Over 1,000 copies of these configuration files were found in public GitHub repositories, containing 1,379 distinct credentials.

The leak mechanism

The problem occurs in an apparently innocent workflow. When a developer uses Claude Code to execute shell commands that include credentials — database passwords, API keys, authentication tokens — the assistant asks for permission before running. The developer can click "Yes, and don't ask again" to avoid having to approve the same command repeatedly.

The problem lies in the fact that instead of recording a generic pattern (like `Bash(npm run:*)`), Claude Code saves the exact command, including the credential in plain text, in a file called `.claude/settings.local.json`. If this file ends up being committed and pushed to a public GitHub repository — whether by accident, by cloning on another machine, or because Claude Code itself committed it — all credentials become exposed.

Apiiro researchers examined 104,185 public copies of this file across 103,617 repositories. About 1.1% of them, or 1,122 copies, contained at least one real credential, totaling 1,379 distinct secrets. When researchers expanded their search to include older versions of the file, shared configuration files, and agent chat transcripts, the total rose to 2,539 secrets across 1,994 repositories.

The nature of the exposed credentials is particularly concerning. More than a third opened direct database access, including 379 database passwords and 122 Supabase service-role keys. Others include 43 SSH logins for public servers, some with root passwords, 42 GitHub, GitLab, and npm tokens, and 23 AWS keys.

Organizational impact

Although most exposed files belonged to individual developers, 63 organizations were affected, from student groups to established vendors. Among them: a database company with a cloud API key with administrative access, a software agency with a production Square token, and the owner password for a medical-records app's cloud database.

Apiiro notified the affected organizations, though it acknowledged that it did not test whether the credentials were still active. One organization confirmed its key was still live.

Why conventional security tools failed

A data point that should alarm security teams: of the 1,122 files with secrets, gitleaks (a widely used secret scanner) flagged only 564, and TruffleHog, another popular scanner, flagged only 643. This means 215 files with credentials in plain text escaped both gitleaks and TruffleHog.

The problem is also not limited to GitHub. The file resides in plain JSON format on developers' machines, where it can be found by malware. In September 2025, the Shai-Hulud worm from the npm registry ran the TruffleHog scanner over files on infected machines, flagging more than half of the files as containing secrets.

Anthropic's response

Boris Cherny, head of Claude Code at Anthropic, acknowledged the issue on a Hacker News forum, saying the company is looking into solutions. "Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this," Cherny said.

The team is planning to prototype approaches including making auto mode catch such commands and integrating a basic secret scanner. However, a reader pointed out that the same exposure could occur in auto mode, and Cherny agreed: "Yeah good catch."

Cherny also argued that since Claude Code adds the file to the developer's global gitignore list on creation, the exposed copies were created manually and pushed. However, researchers observed that in 539 of the 1,105 repositories they traced, a commit listing Claude as co-author changed the file — suggesting that Claude itself frequently commits the settings file.

A problem reported for over a year

Claude Code users have reported this behavior on GitHub issues since August 2025. In December 2025, a report described API keys landing in settings.local.json and ending up in a public repository. An automated bot closed the report as "not planned" in January 2026, after 60 days without a response from the Anthropic team.

The problem is fundamental: Claude Code does not add the file to the project's own .gitignore — it adds it only to the user's global list. This means the protection does not travel with the project. When someone clones the repository or when a folder becomes a repository, the protection vanishes.

What to do

Researchers recommend:

1. Search your GitHub repository for `.claude/settings.local.json` and `.claude/settings.json` in each repository 2. Check git history for older copies 3. Rotate all credentials before cleaning files — deleting the file does not remove previous commits or forks 4. Stop putting secrets in commands. Use secrets manager variables (like `$DB_URL`) instead of plain-text passwords 5. Adopt pattern approval (like `Bash(npm run:*)`) instead of individual commands 6. Add `.claude/settings.local.json` to organization .gitignore templates

The Claude Code case illustrates a growing tension in the development ecosystem: the more power we give to AI-based code assistants, the more vulnerable we become to types of leaks that are not sophisticated exploits but consequences of convenience features. The problem is not that an AI model was "tricked" — it's that a convenience feature saved sensitive data in plain text, and the security ecosystem developers trusted to protect them simply couldn't detect the pattern.

The question to watch: if consolidated scanners like gitleaks and TruffleHog missed nearly 20% of these credentials, how many other secrets are circulating in public repositories without anyone knowing?

Sources: The Hacker News, iTWire, iTnews Australia

✓ Independent sources cross-checked and verified before publishing