Claude Code secrets leak GitHub, Digi Mart USA News: Security researchers at Apiiro have found that Anthropic’s Claude Code AI coding tool has been leaking sensitive credentials through public GitHub repositories. The researchers identified thousands of exposed credentials in configuration files created by the tool, including database passwords, cloud service keys and SSH credentials.
The problem is linked to how Claude Code stores approved shell commands. When a developer selects “Yes, and don’t ask again,” the tool adds that command to a list of permitted actions in the local .claude/settings.local.json file.
If the command contains a password or API token, that sensitive information is saved in the file as well.
The file is meant to remain on the developer’s computer. Claude Code adds it to the user’s global Git ignore list to prevent it from being uploaded to a repository.
However, that protection does not necessarily apply when a project is cloned to another machine or when a folder is later turned into a Git repository, which can allow the settings file to be committed and published publicly. In some cases, Claude Code has itself committed changes to the file.
According to Apiiro, it found more than 104,000 copies of the settings file in public GitHub repositories, and 1,122 of them contained real secrets. By checking Git history and other shared files, the researchers identified 2,539 distinct credentials across nearly 2,000 repositories.
Some affected repositories belonged to companies, including software developers and service providers.
Anthropic is aware of the issue and is examining ways to prevent it from recurring. Boris Cherny, head of Claude Code, said the team is considering built-in secret scanning and changes to how the tool handles command permissions.
He also advised developers to use security scanners and to ensure local settings files are not added to repositories.
Apiiro also reported that two widely used scanners, Gitleaks and TruffleHog, failed to flag 215 of the 1,122 files containing secrets. The researchers noted that passwords embedded in ordinary command lines are particularly difficult to detect.
Developers should check whether .claude/settings.local.json has been committed to public repositories and remove any exposed credentials. Simply deleting the file is not enough, because sensitive information can remain in Git history and project forks.
Apiiro recommends changing any passwords and keys that could have been leaked.
