Anthropic's Claude Code Tool Leaks Thousands of Secrets to Public GitHub Repositories

Anthropic's Claude Code developer tool has been silently saving passwords, API keys, database credentials, and SSH logins into a local settings file that developers accidentally commit to public GitHub repositories. Research from security firm Apiiro, published November 8, found 2,539 distinct real secrets across 1,994 public repositories, tracing the leak to a "Yes, and don't ask again" approval prompt that writes the exact command—secrets included—into .claude/settings.local.json [1].

How the leak works

When a developer asks Claude Code to run a command that requires a secret—such as a database migration or an API call—the tool proposes the full command with the credential embedded. It then asks for permission to execute. If the user selects "Yes, and don't ask again," Claude Code saves that exact command string as an allow rule in .claude/settings.local.json at the repository root [1].

The file is intended to stay on the developer's machine. When Claude Code creates it inside a git repository, it adds the path to the user's global gitignore. But that protection doesn't travel with the project. If the folder becomes a repo later, if the repo is cloned on another machine, or if the file was already tracked, the global ignore does nothing. In 539 of the 1,105 repositories Apiiro traced with secrets, a commit co-authored by Claude Code itself modified the file [1].

Scale and severity

Apiiro scanned 104,185 public copies of .claude/settings.local.json across 103,617 repositories on GitHub's default branches as of November 2. Of those files, 1,122 (1.1%) contained a real secret—636 provider-formatted keys and 743 passwords or tokens paired with public hosts. Another 1,160 secrets appeared in git history, shared settings.json files teams commit intentionally, and agent chat transcripts saved in repos [1].

The exposed credentials include a database vendor's own admin-level cloud key with no expiry, a production Azure Postgres password, a Square production access token, and the owner password for a medical-records database. Sixty-three organizations are affected, ranging from student groups to established vendors. In the median repository with a secret, the file had been committed 217 days earlier; in 118 repos, more than a year [1].

Secret scanners miss most of them

Standard secret scanners look for known key formats—prefixes like sk- or long random strings. But many of these secrets are passwords inside command lines: PGPASSWORD=, sshpass -p, mysql -p, or bearer headers in curl calls. Apiiro ran gitleaks and TruffleHog over all 104,185 files. Gitleaks flagged 564 of the 1,122 secret-bearing files; TruffleHog flagged 643. Neither caught 215 files [1].

The same pattern appears in other agent-generated files: transcripts, memory files, handoff notes, and Copilot auto-approve settings. Apiiro found secrets in 298 shared settings.json files, 120 transcript files, 9 memory files, 33 handoff notes, and 9 Copilot settings files [1].

Prior warnings, no action

GitHub issues reporting this mechanism date back to August 2025 (#5544, #11982, #13106, #91270). None received a reply from Anthropic; three were closed automatically as inactive or duplicate [1]. Independent researchers ironPeak (February 2026) and Lakera (April 2026) also found credentials in Claude Code settings files in npm packages and repositories [1].

A separate GitHub issue filed in the Claude Code repository notes that over 6,000 issues labeled "has repro" have been auto-closed since March 2026, including security-relevant issues like #13106 which led to the Apiiro disclosure [5].

Anthropic's response

After Apiiro shared the research, Boris Cherny, Anthropic's Head of Claude Code, responded on Hacker News on November 7 and through the weekend. He acknowledged the issue: "Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this." He listed approaches the team plans to prototype: "making sure auto mode catches this, building in basic secret scanning," and added "good catch" when a reader noted the same problem can occur in auto mode when it asks about a sensitive command [1][3].

Cherny also argued that .claude/settings.local.json "is meant to stay local" and that exposed copies "were manually created and checked in," pointing to documentation stating the file is gitignored when created [3][6]. He recommended using auto mode over permission rules and enabling secret scanning on GitHub and other hosts [3].

Mitigation steps

Apiiro advises developers to search their GitHub organizations for .claude/settings.local.json and .claude/settings.json, check git history for deleted copies, rotate every credential the files have ever held, and stop typing secrets directly into commands—using environment variables instead so the rule records $DB_URL, not the secret [1]. They also recommend treating all agent folders (.claude/, .cursor/, .gemini/, .specstory/) as secret-bearing, adding them to pre-commit and CI scanning with rules that catch passwords inside commands, and adding .claude/settings.local.json to organizational gitignore templates [1].

The disclosure was reported to each affected organization on November 2–3 and to Anthropic through its disclosure channels [1].