Thousands of live passwords, cloud keys and database logins are sitting in public GitHub repositories because of an ordinary click inside Claude Code. Security researchers counted 2,539 real secrets across 1,994 public repositories, most of them saved when developers told the coding assistant ‘Yes, and don’t ask again’ and it stored the approved command — secret included — in a project settings file. The file was then committed like any other code, and deleting it later did not erase the copies already in git history or forks.
How one click saves the secret
Claude Code asks before running shell commands. Choose ‘Yes, and don’t ask again’ and it saves an allow rule in .claude/settings.local.json, a file inside the project folder. The rule covers exactly what the prompt offered: when that is one specific command rather than a pattern, any password or token typed into it is stored too, in plain text.
The tool does try to keep the file local: the first time Claude Code writes it inside a git repository, it adds the path to the developer’s global git excludes. But that protection lives on one computer only. Claude Code never adds the file to the project’s own .gitignore, so it does not travel with the project.
The researchers traced 1,105 repositories and found that in 539 of them, a commit listing Claude as a co-author changed the settings file — their reading is that Claude Code often commits the file itself, rather than the developer doing so alone.
What the researchers counted
Apiiro’s search of public GitHub found 104,185 copies of the file in 103,617 repositories. About 1.1 percent of them — 1,122 files — hold at least one real secret, together 1,379 distinct secrets. The researchers collected the data between November 1 and 3.
A value counted as a secret when it matched a key format, or when a password or token sat beside a server’s address, and an AI reviewer had to agree. The researchers did not test the credentials or contact any host, so the count measures exposure, not confirmed compromise — though one notified company confirmed its key had been live.
More than a third of the secrets open a database directly, including 379 database passwords. The rest include 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. Sixty-three organizations are among the file owners, mostly software companies of all sizes.
The strongest cases include a database vendor’s own admin-level cloud key and the owner password of a medical-records database. As of Monday 2 November, every file holding a secret was still on its repository’s default branch, and in half of those repositories it had been there for at least 217 days.
Deleting the file does not undo it. Older versions hold 734 more secrets across 509 repositories, and 211 forks of 74 repositories carry them. The shared settings file teams commit on purpose holds secrets in 298 of 76,011 copies, mostly inside allow rules, and saved agent chat logs add more — bringing the total to 2,539 secrets across 1,994 repositories.
Standard scanners miss much of this. The researchers ran gitleaks and TruffleHog over every copy without the tools’ verification step: gitleaks flagged 564 of the 1,122 files and TruffleHog flagged 643, while neither flagged 215. Most misses are passwords typed inside commands, which look like ordinary words rather than keys in a recognizable format.
A warning filed a year ago
This was not newly discovered behaviour. A bug report filed on August 11, 2025 said approved commands with API keys and tokens were being stored word for word in the same file. An automated bot closed that report as ‘not planned’ on January 3 after 60 days without activity.
The four related reports the researchers cite have all been closed by the same bot, the most recent yesterday, and none of them received a reply from Anthropic. That silence is the point: the behaviour was reported more than a year ago.
Of 16 coding agents whose documentation the researchers compared, Claude Code is the only one confirmed to save the full approved command in a project file by default. That comparison is what turns a quirk of one tool into a story about the whole category’s defaults — see our comparison of AI coding assistants.
Our Read
The important thing about this story is what it is not: no prompt injection, no jailbreak, no model misbehaving. It is a defaults problem — a convenience feature that remembers approvals, a file designed to stay local, and a version-control system that never forgets. Each piece is reasonable on its own; together they publish credentials.
That framing matters because the fix is cheap and on Anthropic’s side: redact secrets from saved rules, add the file to the project’s .gitignore automatically, or warn when a rule contains a credential. The researchers’ advice — rotate first, then clean up — is sound, but it asks thousands of users to repair a leak the tool’s design made easy.
The timing sharpens the point. In the same week Claude Code was found putting signed-in users’ account email addresses into HTTP headers — a second case of data meant to stay local travelling further than users expected. Two disclosures in two days, both about the same product, suggest Anthropic’s agent is moving faster than its data-handling guardrails.
The wider lesson reaches beyond Claude Code. Agent folders and memory files now hold the same secrets .env files do, and the usual scanners were built for keys in code, not passwords inside commands. Microsoft’s researchers showed the same blind spot this week, when agents went from a GitHub search to vault theft in five minutes.
Why It Matters
The numbers are the reason this clears the bar: 2,539 secrets, 63 organizations, one confirmed live key, and half the exposed files sitting public for at least 217 days. Anyone who cloned one of those repositories holds the keys, and no scanner sweep catches a fifth of them.
For teams shipping with Claude Code, the check is now a routine one: search the organization for both settings files, including git history, before the next commit rather than after it — and rotate anything the files have ever held first.
What to do if you use Claude Code
The researchers’ checklist starts with a search of your GitHub organization for .claude/settings.local.json and .claude/settings.json, including repository history even where the files are gone. Rotate every password, token and key the files have ever held before cleaning anything up, then untrack the local file and add it to the repository’s own .gitignore.
Going forward, keep secrets out of commands: pass them as variables from a secrets manager, such as $DB_URL, so the saved rule holds the variable name, not the secret. Approve patterns such as Bash(npm run:*) instead of single commands, and open the file on your machine to delete any rule holding a secret — even if it was never committed.
Background
Claude Code is Anthropic’s command-line coding assistant, and its cloud version now sets up repositories by itself. The leak lands as the tool’s footprint keeps growing — which is why a settings-file default, not a model flaw, is the story: the more the assistant is trusted with real work, the more its quiet defaults matter.
Source: Apiiro research and The Hacker News report
0 Comments