Claude Code leaks thousands of secrets on GitHub

Anthropic's Claude Code has been leaking sensitive credentials through public GitHub repositories. Security researchers at Apiiro found thousands of exposed credentials in configuration files created by the AI coding tool, including database passwords, cloud service keys and SSH credentials.

The issue is linked to the way Claude Code saves approved shell commands. When a developer chooses “Yes, and don't ask again”, the tool adds the command to a list of permitted actions in the local .claude/settings.local.json file. If that command contains a password or API token, the sensitive information gets saved in the file as well.

This file is supposed to stay on the developer's computer, and Claude Code adds it to the user's global Git ignore list to prevent it from being uploaded to a repository. However, this protection does not necessarily apply when a project is cloned to another machine or a folder is later turned into a Git repository. As a result, the settings file can end up being committed and uploaded publicly. In some cases, Claude Code has even committed changes to the file itself.

Apiiro found more than 104,000 copies of the settings file in public GitHub repositories. Some 1,122 of them contained real secrets. The researchers also identified 2,539 distinct credentials across nearly 2,000 repositories by checking Git history and other shared files. These included database passwords, cloud service keys, API tokens and private SSH credentials. Some of the affected repositories belonged to companies, including software developers and service providers.

Anthropic knows about the issue and is looking at ways to prevent it from happening again. Boris Cherny, the head of Claude Code, said the team is considering built-in secret scanning and changes to how the tool handles command permissions. He also advised developers to use security scanners and make sure local settings files are not added to repositories.

However, existing security tools do not catch everything. Apiiro found that two popular scanners, Gitleaks and TruffleHog, failed to flag 215 of the 1,122 files containing secrets. Passwords embedded in regular command lines are particularly difficult to detect.

For now, developers should check whether .claude/settings.local.json has been committed to public repositories and remove any credentials that may have been exposed. Simply deleting the file is not enough, as sensitive information can remain in Git history and project forks. Apiiro recommends changing any passwords and keys that could have been leaked.