Claude Code AI tool exposed thousands of secrets on GitHub

Security firm Apiiro discovered that Anthropic’s Claude Code exposed thousands of passwords, API tokens, and server credentials on public GitHub repositories. The issue involves commands approved by developers and stored in local configuration files.

Researchers found 2,539 real credentials across 1,994 public repositories, affecting 63 organizations. The exposed material included database passwords, SSH logins, cloud keys, and software tokens.

“The only response reported so far comes from Boris Cherny of the Claude Code team, replying on Hacker News.”

The leak happens because Claude Code saves commands in a file called .claude/settings.local.json when a developer chooses “Yes, and don’t ask again.” This file can contain secrets in plain text inside the project folder.

Although Claude Code adds the file to a global ignore list, it does not add it to the project’s own .gitignore. As a result, the file can be committed when a folder is shared, cloned, or set up to use Git.

Apiiro identified 104,185 public copies of the settings file, of which 1,122 contained at least one real secret. In total, 1,379 distinct secrets were found in those files.

When git history and other files are included, the total rises to 2,539 secrets across 1,994 repositories. The secrets belonged mostly to software companies.

Anthropic had not published a fix as of 8 November. A member of the Claude Code team responded on Hacker News, saying the file is ignored automatically when Claude creates it.