Claude Code leak exposes thousands of GitHub secrets
5 min read
Security researchers have discovered that Claude Code saves permanently approved shell commands verbatim to .claude/settings.local.json, including any passwords and API keys they contain. Research from security firm Apiiro found 2,539 credentials across nearly 2,000 public GitHub repositories, with secrets such as database passwords, cloud keys, API tokens, and SSH root logins among the exposed data. No fix had shipped as of 11 November 2026.
The Scale of the Exposure
Apiiro examined 104,185 publicly accessible copies of .claude/settings.local.json on GitHub, finding that 1,122 files contained real secrets. The researchers identified 1,379 distinct secrets in those files alone, including 636 provider-specific keys and 743 passwords or tokens associated with public hosts.
A separate analysis by GitGuardian revealed an even larger scope. GitGuardian found more than 31,000 unique secrets in .claude/settings.local.json files across over 23,000 repositories, and more than 5,000 of them were active at the time of discovery.
About 1,100 of those files from 63 organizations contained secrets, with one organization confirmed its exposed key had been live.
How the Vulnerability Works
Researchers at Apiiro discovered that Claude Code stores user-approved shell commands in a local settings file. When users select the option to automate future approvals, the tool saves these commands, which often contain database passwords, API tokens and root logins, directly into the file.
By default, Claude Code asks before it runs most shell commands. However, when users choose the “Yes, and don’t ask again” option, approving persistent execution stores the literal command as an allowlist rule rather than stripping its sensitive arguments.
The problem escalates when developers commit these files to version control. Claude Code is not being overtly careless; it does try to protect files when it creates its .claude/settings.local.json file inside a Git repository. This prevents it from being included in routine commits. However, although Claude Code adds the settings file to a developer’s global Git ignore list when created inside a repository, that protection does not travel with the project.
Types of Credentials Exposed
The exposed credentials span a wide range of sensitive systems. Apiiro found that databases accounted for a large share of exposed access, including 379 database passwords and 122 Supabase service-role keys. Some SSH commands contained root passwords.
Additional exposed credentials include 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys.
Detection Challenges
Standard security scanning tools have not caught all exposed secrets. According to a research report published by security firm Apiiro on November 5, 2026, local settings files for Anthropic’s development tool Claude Code were found in more than 100,000 public GitHub repositories, and 1,122 of them contained secrets such as API tokens and database passwords.
Of 16 coding agents whose documentation the researchers compared, Claude Code is the only one confirmed to save the full approved command in a project file by default.
Anthropic’s Response
The issue was first reported back in August 2025, though the issue was not widely known until Apiiro’s research surfaced it in November 2026.
Boris Cherny, Anthropic’s head of Claude Code, said in a Nov. 7 Hacker News discussion that the company was considering built-in scans for exposed credentials and added safeguards in Claude Code’s automated permission system. Claude Code creator Borys Chernyi said developers are studying how to prevent such situations. He advised users to use secret-scanning tools and said the team is considering integrating such a check into Claude Code.
Recommended Actions for Users
Apiiro advised organizations to search public repositories for .claude/settings.local.json and .claude/settings.json, review Git history for deleted copies and rotate every credential the files may have contained.
Key Facts
- 2,539 credentials found across 1,994 public GitHub repositories according to Apiiro’s November 1-3, 2026 scan
- 31,000+ unique secrets discovered by GitGuardian across 23,000+ repositories, with 5,000+ active at discovery
- 1,122 files containing real secrets out of 104,185 examined settings files
- 63 organizations affected by the credential exposure
- No fix shipped as of November 11, 2026
- Issue first reported in August 2025, became widely known in November 2026
Sources
- Advisori: Claude Code Leak: 31,088 Secrets on GitHub
- Dark Reading: AI Coding Agents Leak Thousands of Secrets to GitHub
- The Hacker News: Claude Code’s “Don’t Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
- Dataconomy: Claude Code Flaw Exposes Passwords And Keys On Public GitHub Repositories
Sources
- Claude Code Leak: 31,088 Secrets on GitHub
- AI Coding Agents Leak Thousands of Secrets to GitHub
- Passwords and API keys from Claude Code settings ended up in public GitHub repositories – AIN
- Claude Code’s “Don’t Ask Again” Feature Exposes 2,539 Secrets Across 1,994 GitHub Repositories
- Claude Code settings files expose sensitive data on GitHub
- Claude Code’s “Don’t Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
- Claude Code’s “Yes, and Don’t Ask Again” Option Can Leak Passwords and API Keys to GitHub
- Claude Code’s “Don’t Ask Again” Option Can Save Plaintext Secrets That End Up on GitHub
- Claude Code Accidentally Exposes Secrets on GitHub, Including Passwords, API Keys, and More
- Claude Code Flaw Exposes Passwords And Keys On Public GitHub Repositories – Dataconomy
