Claude Code leaked passwords and keys in 1,122 public GitHub files

Passwords and API keys developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. That is the finding of research by security company Apiiro, published on 5 November 2026 and covered by The Hacker News.

The problem is the “Yes, and don't ask again” mode. Approving a command with that option makes Anthropic's coding assistant save the permission rule in the project's .claude/settings.local.json file — and when the rule covers one exact command, the whole command is saved word for word, including any password or token typed into it, in plain text.

What Apiiro found

Researchers scanned public GitHub and found 104,185 copies of the file in 103,617 repositories. Of those, 1,122 copies (about 1.1%) held at least one secret, adding up to 1,379 distinct secrets in current copies of the local file alone. Counting git history, the shared .claude/settings.json file and saved agent chat logs, the total reaches 2,539 secrets across 1,994 repositories, involving 63 organizations.

  • 379 database passwords — more than a third of the secrets give direct access to a database;
  • 43 SSH logins for public servers;
  • 42 tokens for GitHub, GitLab and npm;
  • 23 AWS keys;
  • Among the most serious cases, researchers say, are an admin-level cloud key belonging to a database vendor and the owner password of a medical-records database.

Deleting the file from the project does not undo the leak: older versions remain in git history and in forks. Researchers found another 734 secrets in older versions of the file, across 509 repositories, and 211 forks of 74 repositories carrying the same secrets. On the Monday of the week of publication, every file containing a secret was still on its repository's default branch — and in half of them, it had been there for at least 217 days.

Why scanners missed so much

Researchers ran the secret scanners gitleaks and TruffleHog over the 1,122 secret-bearing copies: gitleaks flagged 564 and TruffleHog 643 — and 215 were flagged by neither. Most misses are passwords typed inside commands, which do not match a known key format and look like ordinary words in a command line.

A design detail sits at the centre of the problem: Claude Code adds the file to the user's global git excludes when it creates it, but never adds it to the project's own .gitignore — so the protection does not travel with the code. In 539 of the 1,105 repositories traced, a commit listing Claude as co-author changed the file, suggesting the agent itself often commits it.

What to do now

The researchers' advice is to rotate credentials before any cleanup:

  1. Search your GitHub organization for .claude/settings.local.json and .claude/settings.json, and check each repository's git history, even where the files are gone;
  2. Rotate first: change every password, token and key the files have ever held, before cleaning up;
  3. Remove the local file from version control with git rm --cached .claude/settings.local.json and add it to the repository's own .gitignore;
  4. Open the file on your own computer and delete any rule containing a secret, even if it was never pushed to GitHub;
  5. Never put secrets inside commands: reference them as variables from a secrets manager, such as $DB_URL, so the saved rule holds the variable name, not the secret;
  6. Approve patterns, such as Bash(npm run:*), instead of single commands.

An old warning, unanswered

Claude Code users had reported this behaviour before: a bug report filed on 11 August 2025 said approved commands with API keys and tokens were being stored word for word in settings.local.json. An automated bot closed the report as “not planned” on 3 January, after 60 days without activity. According to the researchers, all four related reports cited in the study were closed by the same bot — the most recent the day before publication — and none received a reply from Anthropic.

One limit of the findings is worth stating plainly: Apiiro did not test whether the credentials found still work — a “real secret” in the study means a value that matched a known format or a verified context, with agreement from an AI reviewer. One notified company confirmed its key had been live at the time of discovery. Of the 16 coding agents whose documentation the researchers compared, Claude Code is the only one confirmed to save the full approved command in a project file by default.

Geekiki has already covered another security case involving Claude Code: Claude bypassed Anthropic's safety monitor with fiction and beekeeping.

Sources

Image credit: The Hacker News.

Transparency note: this article was produced with the help of artificial intelligence, cross-checking public information from internet sources, including Apiiro's original research and The Hacker News coverage. The facts were verified against the cited sources; consult the original sources to confirm the details.

Muse