Claude Code setting leaked 1,379 secrets across public GitHub repos

Summary

• Apiiro found 1,379 secrets exposed in Claude Code local settings files on public GitHub repositories.
• A don't-ask-again prompt writes approved commands, including embedded passwords, verbatim into the project config file.
• Affected teams are told to rotate every credential, since half the exposures sat public for 217 days.

The latest

A local configuration file created by Anthropic's Claude Code has exposed 1,379 distinct secrets across public GitHub repositories, cybersecurity firm Apiiro said in research by Shmulik Cohen and Matan Giladi. Counting logs and saved agent conversations, the total reaches 2,539 secrets in 1,994 repositories. More than a third of the credentials open databases directly.

Details

• The mechanism: When a developer approves a command and selects not to be asked again, Claude Code writes an allow rule into .claude/settings.local.json inside the project. If the approved command contains a password or token typed inline, that credential is stored in cleartext. The rule can be a pattern such as npm test * or the literal command itself.
• The numbers: Apiiro counted 104,185 copies of the file across 103,617 public repositories. Of those, 1,122 copies — about 1.1% — held at least one secret. The haul included 379 database passwords, 43 SSH credentials, 42 GitHub, GitLab and npm tokens, and 23 AWS keys, belonging to 63 organizations, mostly software companies.
• Exposure window: Every file containing a secret was still on the repository's default branch, and half had been exposed for at least 217 days, Apiiro said. Older versions of the same files carried a further 734 secrets across 509 repositories, while 211 forks from 74 repositories replicated the identical credentials.
• The partial safeguard: Claude Code adds the file to git's global exclude list on the user's machine the first time it writes it. Apiiro said that protects only that one machine, does nothing about files already pushed, and is never added to the project's own .gitignore, leaving collaborators and forks unprotected.
• Scanners missed it: Gitleaks flagged 564 of the 1,122 files and TruffleHog flagged 643, with 215 missed by both. Apiiro attributed the gap to passwords embedded inside shell commands — after PGPASSWORD=, sshpass -p or mysql -p — which read as ordinary text rather than recognizable credential formats.
• Scope of the agent: Of 16 coding agents Apiiro compared, Claude Code was the only one confirmed to store the full approved command in a project file by default. The shared .claude/settings.json file carried secrets in 298 of 76,011 copies, a far lower rate than the local variant.
• Anthropic's position: No response from the company has been published. A bug report filed on 11 August 2025 describing the behavior was closed by an automated bot as not planned on 3 January after 60 days of inactivity, and four linked reports were auto-closed without a reply. Anthropic's documentation states the option saves an allow rule in the project's local settings file.
• Disclosure timeline: Apiiro collected the data from public GitHub between 1 and 3 November 2026 and notified affected parties on 2 and 3 November. One organization confirmed its exposed key was still valid. Apiiro did not test whether the remaining secrets worked.
• What teams should do: Apiiro recommended searching both settings files and their history, rotating every password, token and key they contained, untracking the local file with git rm --cached, adding it to .gitignore, pulling secrets from a secrets manager, and scanning agent folders including .claude/, .cursor/, .gemini/ and .specstory/ in CI.

Between the lines

The risk is structural rather than accidental. The file is excluded locally but never at the project level, so a credential is protected on the machine that created it and exposed everywhere it is copied — which is how 211 forks ended up carrying identical secrets. Standard scanners missing 215 files means teams relying on automated gates would see no alert.

What's next

Watch for an Anthropic response or a default change in how Claude Code stores approved commands, and for whether the auto-closed bug reports are reopened. Affected organizations face credential rotation across 63 companies.

Source: Apiiro, The Hacker News, ITWire