Anthropic's Claude Code leaks thousands of credentials

Security researchers have discovered thousands of passwords, API keys, and other sensitive credentials leaked in public GitHub repositories through a convenience feature in Anthropic’s Claude Code. Apiiro’s research examined 104,185 public copies of .claude/settings.local.json and found real secrets in 1,122 files, holding 1,379 distinct credentials, while GitGuardian found more than 31,000 unique secrets in .claude/settings.local.json files across over 23,000 repositories.

Collection took place November 1–3, 2026, with reports emerging throughout the week as the security implications became clear. The leaked credentials include database passwords, cloud service keys, API tokens, and SSH root logins belonging to 63 organizations.

How the Leak Occurs

The leak starts during ordinary development work when a developer asks Claude Code to check a database, test an API, or troubleshoot a failed login, and Claude prepares a shell command containing a credential from a configuration file, then asks for permission before running it.

Choosing “Yes, and don’t ask again” can store that command, including its secret, in .claude/settings.local.json. The command becomes an allow rule, letting Claude Code run it again without another prompt. The danger comes when that local file is committed and pushed to GitHub.

In 539 of the 1,105 repositories containing real secrets that the researchers investigated, a commit co-authored by Claude Code had modified the affected settings file. Claude Code’s commit instructions tell the model not to commit .env or credentials.json. Its own settings file is not on that list.

Scope and Types of Exposed Secrets

The credentials discovered in public repositories represent a significant security exposure across multiple categories:

Database passwords and connection strings
Cloud service keys, including 23 AWS keys
API tokens for various platforms
43 SSH logins for public servers
42 GitHub, GitLab, and npm tokens
122 Supabase service role keys

More than a third of the secrets open a database directly, including 379 database passwords and 122 Supabase service role keys. Some exposed commands even contained root-level SSH passwords, creating critical security vulnerabilities.

Apiiro found that two popular scanners, Gitleaks and TruffleHog, failed to flag 215 of the 1,122 files containing secrets, meaning traditional security tools missed a substantial portion of the exposed credentials.

Why Standard Protections Failed

The file is meant to stay on the developer’s machine, and Claude Code tries to keep it there. When it creates the file inside a git repo, it adds it to the developer’s global git ignore list. That covers the common case.

However, Claude Code never adds the file to the project’s own .gitignore, so the protection does not travel with the project. This means when repositories are cloned or forked by other developers without that global configuration, the protection disappears.

Removing it from a project does not undo the leak, because older versions stay in git history and in forks of the repository. This persistence makes remediation particularly challenging, as the secrets remain accessible even after deletion from current branches.

Additional Security Concerns

Beyond the GitHub exposure, researchers identified another vulnerability: The secrets are stored in plain JSON in the same file path in ever project, one file search away for any malware that happens to be running on the system. This creates a local attack vector separate from the public repository issue.

They discovered 613 unique secrets from Claude Code settings files in those images, 99 of which were valid, indicating that many of the exposed credentials remained active and could potentially be exploited.

Anthropic’s Response

Anthropic’s head of Claude Code responded, saying they are “looking into what we can do to prevent this.” Boris Cherny, the head of Claude Code, said the team is considering built-in secret scanning and changes to how the tool handles command permissions.

However, Anthropic hadn’t published a fix as of 8 November, leaving users vulnerable while the company develops a solution.

Recommendations for Users

Security experts recommend several immediate actions for Claude Code users:

Search your GitHub organization for .claude/settings.local.json and .claude/settings.json, and check each repository’s git history for them, even where the files are gone
Rotate all credentials that may have been exposed through these settings files
Add .claude/ to project-specific .gitignore files manually
Treat agent folders such as .claude/, .cursor/, .gemini/ and .specstory/, and agent memory files, as holding secrets, like .env files, on laptops as well as in repositories

The incident highlights broader security challenges as AI coding assistants become more integrated into development workflows, particularly around how these tools handle sensitive data and interact with version control systems.

Key Facts

Apiiro found 1,122 public GitHub repositories containing Claude Code settings files with real secrets
GitGuardian identified 31,000+ unique secrets across 23,000+ repositories
Data collection occurred November 1–3, 2026
539 repositories showed Claude Code itself had committed the exposed files
215 files with secrets evaded detection by popular scanning tools Gitleaks and TruffleHog
Affected credentials include database passwords, cloud keys, API tokens, and SSH logins from 63 organizations
Anthropic had not shipped a fix as of November 8, 2026

Sources

Written by

Mike Gingerich

Author

Author: Mike Gingerich, President of web firm Digital Hill, Co-Founder of TabSite .
Digital and Social Media Marketer, Speaker, and Business Consultant. Part geek, part marketer, total digital junkie! Seeking to add value, make the complex simple, and leave a positive impact.

Follow me on twitter: @mike_gingerich.