Ars Technica reports that security firm Apiiro found real passwords and API keys from Claude Code in 1,122 of 103,617 public GitHub repos.
The leak starts with a convenience button. When you approve a command with “Yes, and don’t ask again”, Claude Code stores it as a rule in a local file, .claude/settings.local.json, often exactly as typed. If that command held a database password or token, the secret now sits in plain text in your project folder, one careless commit away from the open web.
What leaked
Apiiro counted 104,185 copies of the settings file across 103,617 public repos. About 1.1% of them (1,122 files) held at least one real secret, 1,379 secrets in all. Once git history and other files are included, the total rises to 2,539 secrets across 1,994 repos. The Hacker News lists the main types (not all of the 1,379):
- 379 database passwords
- 43 SSH logins
- 42 GitHub, GitLab, and npm tokens
- 23 AWS keys
The secrets belonged to 63 organisations, mostly software companies. Apiiro didn’t test whether the credentials still work, but one company it notified confirmed its key was live. It’s unclear whether attackers have used any of them.
GitGuardian, using a different method, found a bigger pile: 31,088 secrets pushed to public GitHub in the same file across 23,276 repos, with 5,343 still valid when detected.
Why it keeps happening
Claude Code never adds the file to the project’s own .gitignore, though a team member later said it’s ignored automatically when Claude creates it. Its protection is a git exclude on your machine, so it doesn’t travel with the project to a new clone or a teammate’s laptop. Of 16 coding agents Apiiro compared from their documentation, Claude Code was the only one confirmed to save the full approved command in a project file by default.
Claude itself had a hand in some cases. iTWire reports that Claude, listed as co-author, changed the file in 539 of 1,105 repos traced. The co-author tag doesn’t show Claude pushed every credential.
Anthropic hadn’t published a fix as of 8 November. The only response reported so far comes from Boris Cherny of the Claude Code team, replying on Hacker News. Developers Digest and Ars say he told readers Claude Code hasn’t historically scrubbed secrets. He also said the team is looking at prevention and considering built-in secret scanning, and that Claude gitignores the file automatically when it creates it. For now, he recommends secret scanners.
What to do if you use Claude Code
Rotate first. Change every password, token, and key the file ever held, then clean up. Deleting the file won’t undo the leak, because git history and forks keep copies. In half the affected repos, the file had sat on the default branch for at least 217 days.
Scanners help, but don’t lean on them alone. Developers Digest says gitleaks flagged 564 of the 1,122 leaky files and TruffleHog 643, while 215 slipped past both.
It’s not the first time AI tools and GitHub have made an awkward pair. Tbreak covered AI posing as developers on GitHub earlier, and has also covered Claude Code’s Projects and parallel sessions. Until Anthropic ships a fix, the advice is to rotate credentials and run a secret scanner.
