Science & Tech · Cybersecurity · 5 hrs ago
Claude Code settings exposed passwords and keys in public GitHub repositories
Anthropic's Claude Code saved secrets in settings files when developers approved a command and chose “Yes, and don't ask again.”
The files could include passwords, API keys and SSH credentials typed into the command.
Apiiro found 1,122 public GitHub files with real secrets, among more than 100,000 copies of the settings file it found.
The tool tries to keep the file out of Git, but that protection is tied to one developer's computer and does not travel with a project.
Some security scanners also missed files containing secrets, and researchers did not check whether most exposed credentials still worked.
Anthropic is considering built-in secret scanning and changes to command permissions, but it has not said when any fix will be available.
Developers are advised to check public repositories and Git history, then change any passwords and keys that may have leaked; deleting a file alone may not remove it from history or project forks.
Anthropic’s Claude Code can save passwords, API keys and other credentials in project settings files that are later exposed in public GitHub repositories.
Security firm Apiiro found 1,122 public copies of the file containing at least one real secret.
The exposure stems from a permission feature that saves approved shell commands, including any secrets typed into an exact command.
Anthropic said it is looking at ways to prevent further leaks, including built-in secret scanning.
Researchers warned that deleting exposed files may not remove copies retained in Git history or repository forks.
- Who
- Users of Anthropic’s Claude Code and organisations whose credentials appeared in public repositories.
- What
- A Claude Code settings file saved secrets in approved commands and was found in public GitHub repositories.
- When
- The reports were published from November 7 to 9, 2026.
- Where
- Public GitHub repositories.
- Why
- Selecting “Yes, and don't ask again” can save an exact approved shell command, including passwords or tokens, in a project settings file.
This story does not have two clearly opposing sides.
Apiiro shared its research with Anthropic.
The Hacker News reported that Apiiro found 1,122 public copies of the settings file containing secrets.
iTnews reported on the exposed credentials and Anthropic’s response.
Notebookcheck and Ars Technica published reports about the exposure.
- Settings file
- .claude/settings.local.json
- Copies found
- 104,185 copies across 103,617 public GitHub repositories
- Files with secrets
- 1,122
- Distinct secrets in current files
- 1,379, according to iTnews and The Hacker News
- Secrets across older files and other shared material
- 2,539 across 1,994 repositories, according to Apiiro as reported by Notebookcheck and iTnews
6 sources
AI Coding Agents Leak Thousands of Secrets to GitHub
Claude Code settings files expose sensitive data on GitHub
Claude Code leaks thousands of secrets on GitHub
Claude Code is accidentally exposing secrets all over GitHub
"Don't ask again" in Anthropic's Claude Code leaks developer secrets
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
What people are saying
Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this
Yeah good catch