A convenience feature in Anthropic’s Claude Code has led to real credentials being published on GitHub, according to research from application security firm Apiiro.
How it happens
Claude Code asks before it runs most shell commands. If a developer picks “Yes, and don’t ask again”, the tool saves an allow rule to .claude/settings.local.json in the project folder. When that rule records an exact command, any password or token typed into the command is saved with it, in plain text.
Claude Code adds the file to the developer’s global gitignore when it creates it, but Apiiro says that protection doesn’t travel with the repository, so copies still end up committed.
What Apiiro found
| Finding | Apiiro’s figure |
|---|---|
| Public copies of the file on GitHub | 104,185 |
| Files holding at least one real secret | 1,122 |
| Distinct secrets in those files | 1,379 |
| Total across all agent files and history | 2,539 secrets in 1,994 repos |
| Organisations affected | 63 |
The haul included 379 database passwords, 43 SSH logins and 23 AWS keys. Apiiro did not test whether credentials still worked, though one organisation it notified confirmed its key had been live. Popular scanners gitleaks and TruffleHog each missed hundreds of the files, because passwords inside commands don’t look like known key formats.
Anthropic’s response
Boris Cherny, head of Claude Code, said on Hacker News that the team is “looking into what we can do to prevent this”, including basic secret scanning. No fix had been announced at the time of writing.
What to do
- Search your repos and git history for
.claude/settings.local.json. - Rotate every credential it has ever held before deleting it.
- Add it to each repo’s own
.gitignore. - Use environment variables, not typed secrets, and approve command patterns rather than exact commands.
