Claude Code Leak Exposes 2,539 Secrets on GitHub

Security firm Apiiro has disclosed that Anthropic’s Claude Code assistant exposed 2,539 credentials across 1,994 public GitHub repositories after developers used the tool’s “Yes, and don’t ask again” permission feature. The scan took place between November 1 and 3, 2026, and the research was published on November 5, 2026. The problem occurs when users select “Yes, and don’t ask again” to approve a command, which stores the full command, including any embedded secrets, in a project file at .claude/settings.local.json, and the file is later committed and pushed to GitHub.

How the Leak Mechanism Works

Claude Code prepares a shell command containing a credential from a configuration file, then asks for permission before running it. When a user selects “Yes, and don’t ask again,” Anthropic’s AI coding assistant saves the command, word-for-word, including the secret, in a project settings file. The command becomes an allow rule, letting Claude Code run it again without another prompt.

The file is .claude/settings.local.json, and removing it from a project does not undo the leak because older versions stay in git history and in forks of the repository. Claude Code never adds the file to the project’s own .gitignore, so the protection does not travel with the project.

Scale of the Exposure

Apiiro’s research examined 104,185 public copies of .claude/settings.local.json and found real secrets in 1,122 files, holding 1,379 distinct credentials. Checking earlier commits, shared settings, and agent transcripts brought the total to 2,539.

Databases accounted for a large share of exposed access, including 379 database passwords and 122 Supabase service-role keys. Other findings included cloud credentials, private keys, package-registry tokens, and 43 SSH logins. Exposed secrets also included 42 GitHub/GitLab/npm tokens and 23 AWS keys on default branches.

Another 734 secrets turned up in older file versions across 509 repositories, deleted from the current tree but still readable in history, and 211 forks carried identical secrets copied from the original. Exposed material affected 63 organizations, and one organization confirmed its exposed key had been live.

Beyond Local Settings Files

Secrets also sit in 298 of 76,011 copies of the shared .claude/settings.json file, which teams commit on purpose, mostly inside allow rules. The exposure extended beyond current configuration files, with historical versions containing 734 secrets absent from current copies, while shared .claude/settings.json files and agent transcripts expanded the overall count.

Anthropic’s Response

Anthropic’s Claude Code lead acknowledged the issue but existing fixes may not fully solve it. Anthropic’s Boris Cherny pointed out on Hacker News that Claude Code gitignores the settings file on creation, suggesting the exposed copies were manually created and checked in. However, every copy Apiiro found was sitting on its repo’s default branch on November 2, 2026, and most had been there a long time.

Key Facts

Apiiro examined 104,185 public copies of .claude/settings.local.json and found 1,122 files containing 1,379 distinct credentials
The total reached 2,539 secrets after checking earlier commits, shared settings, and agent transcripts
The scan took place between November 1 and 3, 2026
Findings included 379 database passwords, 122 Supabase service-role keys, 43 SSH logins, 42 GitHub/GitLab/npm tokens, and 23 AWS keys
The exposure affected 63 organizations, with one confirming its exposed key had been live
Apiiro published its research on November 5, 2026

Sources

Written by

Mike Gingerich

Author

Author: Mike Gingerich, President of web firm Digital Hill, Co-Founder of TabSite .
Digital and Social Media Marketer, Speaker, and Business Consultant. Part geek, part marketer, total digital junkie! Seeking to add value, make the complex simple, and leave a positive impact.

Follow me on twitter: @mike_gingerich.