Anthropic’s Claude Code leak exposes 2,539 GitHub secrets
5 min read
A security vulnerability in Anthropic’s Claude Code has exposed thousands of sensitive credentials in public GitHub repositories. Researchers at Apiiro found 2,539 secrets across 1,994 public GitHub repositories, including database passwords, cloud keys, API tokens, and SSH root logins. The issue stems from Claude Code’s “Yes, and don’t ask again” feature, which saves approved commands to .claude/settings.local.json inside project folders, including embedded secrets.
How the Leak Occurred
The vulnerability activates when users ask Claude Code to access a database or call an API that requires a secret. When users select “Yes, and don’t ask again,” an allow rule is saved to .claude/settings.local.json in the project folder. The problem is that this convenience feature records the complete command exactly as typed, preserving any passwords, API keys, or other credentials embedded within.
While the file is meant to stay on the developer’s machine, and Claude Code attempts to keep it there by adding it to the developer’s global git ignore list, the protection proved insufficient. In 539 of the 1,105 repositories researchers traced, a commit listing Claude as a co-author changed the file, suggesting the AI assistant itself may have contributed to exposing these credentials.
Scale of the Exposure
Apiiro researchers Shmulik Cohen and Matan Giladi examined 104,185 public copies of local Claude Code settings files across 103,617 GitHub repositories and found that about 1.1% contained what they classified as real secrets, totaling 1,379 distinct credentials.
The exposed credentials include a wide range of sensitive access points:
- 379 database passwords
- 122 Supabase service role keys
- 43 SSH logins for public servers, some of them root passwords
- 42 GitHub, GitLab, and npm tokens
- 23 AWS keys
Together the files hold 1,379 different secrets, with forks spreading the files further across 211 forks of 74 repositories, and including older versions and saved agent chat logs, the total reaches 2,539 secrets across 1,994 repositories.
The secrets belonged to 63 organizations, mostly software companies. A separate analysis by GitGuardian using different methodology found 31,088 secrets pushed to public GitHub in the same file across 23,276 repos, with 5,343 still valid when detected.
Vulnerabilities Beyond GitHub
The security risk extends beyond public repositories. The secrets are stored in plain JSON in the same file path in every project, one file search away for any malware that happens to be running on the system. This means that even credentials never pushed to GitHub remain vulnerable to local threats on developer machines.
Researchers were able to reproduce the behavior in the latest models, Opus 5.5 and Fable 5.1, as well, indicating the issue persists in current versions of the software.
Anthropic’s Response
Anthropic’s head of Claude Code responded, saying they are “looking into what we can do to prevent this”. Boris Cherny, Anthropic’s head of Claude Code, said in a Nov. 7 Hacker News discussion that the company was considering built-in scans for exposed credentials and added safeguards in Claude Code’s automated permission system.
Cherny advised developers to use security scanners and make sure local settings files are not added to repositories.
What Developers Should Do
Deleting the file won’t undo the leak, because git history and forks keep copies. Security experts recommend several immediate actions:
- Search your GitHub organization for .claude/settings.local.json and .claude/settings.json, and check each repository’s git history for them, even where the files are gone
- Review Git history for deleted copies and rotate every credential the files may have contained
- Treat agent folders such as .claude/, .cursor/, .gemini/ and .specstory/, and agent memory files, as holding secrets, like .env files, on laptops as well as in repositories
Key Facts
- Apiiro discovered 2,539 distinct secrets across 1,994 public GitHub repositories
- 1,122 Claude Code settings files contained at least one real secret out of 104,185 files examined
- The vulnerability affects the latest Claude Code models, including Opus 5.5 and Fable 5.1
- 379 database passwords were among the exposed credentials, along with 43 SSH root logins and 42 source code repository tokens
- GitGuardian found 5,343 still-valid secrets using a different scanning methodology
- In 539 repositories, commits listing Claude as co-author modified the settings files
Sources
- Privacy Guides: Claude Code Leaks Secrets and Passwords in Public GitHub Repositories
- The Hacker News: Claude Code’s “Don’t Ask Again” File Exposes Passwords and Keys
- Dataconomy: Claude Code Flaw Exposes Passwords And Keys On Public GitHub Repositories
- Notebookcheck: Claude Code leaks thousands of secrets on GitHub
Sources
- Claude Code Leaks Secrets and Passwords in Public GitHub Repositories
- Claude Code’s “Don’t Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
- “Don’t ask again” in Anthropic’s Claude Code leaks developer secrets – iTnews
- Claude Code Flaw Exposes Passwords And Keys On Public GitHub Repositories – Dataconomy
- Claude Code secrets leaked on GitHub repos
- Claude Code Secrets Leak to GitHub via ‘Don’t Ask Again’
- Claude Code leaks thousands of secrets on GitHub – Notebookcheck News
