Claude Code leaks expose thousands of secrets on GitHub

Claude Code leaks have exposed thousands of credentials in public GitHub repositories, according to application security company Apiiro. Researchers found passwords, API tokens and cloud keys inside local settings files that recorded commands developers had approved.

Approved commands carried credentials into repositories

Apiiro identified 104,185 public copies of .claude/settings.local.json across 103,617 GitHub repositories. Among those files, researchers found 2,539 sensitive secrets across 1,994 repositories. The exposed information included service tokens, database passwords, AI model API keys and dozens of SSH root logins.

Some credentials provided access to particularly sensitive systems. Examples included an administrative cloud key belonging to a database vendor and the owner password for a medical-records database. Researchers also identified a production Azure PostgreSQL password and a Square production token.

Most affected repositories belonged to individual developers. However, Apiiro also counted 63 organizations, including startups, software agencies and established vendors. The findings therefore extended beyond personal coding projects.

How Claude Code leaks happen

According to Apiiro, selecting “Yes, and don’t ask again” can save an approved terminal command in the local settings file. If that command contains a password or token, the permission rule can retain it in plain text. Publishing the file then exposes the credential alongside the project.

Claude Code attempts to exclude the file from Git through an ignore rule. However, researchers said that protection can fail across machines, newly created repositories and files that Git already tracks. They also noted that a global exclusion rule does not travel with the project.

In a separate analysis of 1,105 repositories containing exposed real secrets, Apiiro found Claude coauthorship on 539 relevant commits. Those commits changed the affected settings file. This suggests the agent itself participated in publishing some sensitive material.

Scanners can miss passwords inside commands

Apiiro said tools such as Gitleaks and TruffleHog often missed credentials embedded in ordinary command lines. Scanners can recognize familiar token prefixes and distinctive key formats. By contrast, a password passed as a command argument may resemble routine text.

Researchers also found secrets in chat transcripts, agent memory files, deployment notes and handoff documents. Additionally, they identified exposure in VS Code Copilot approval settings and similar files on GitLab and Hugging Face. The problem consequently reaches beyond one configuration file or hosting platform.

Anthropic reviews ways to prevent exposure

Anthropic’s Claude Code lead Boris Cherny said the team was investigating preventive changes. He stated that Claude automatically excludes the settings file when creating it and attributed the reported cases to manually created and committed files. Cherny also recommended automatic approval mode and GitHub secret scanning.

Meanwhile, Apiiro urged developers to rotate exposed credentials and remove permission rules containing plaintext secrets. Deleting a public file leaves possible copies in Git history, forks and clones. The researchers also recommended keeping sensitive agent files out of repositories, packages, container images and archives.

To reduce future Claude Code leaks, developers can reference credentials through environment variables backed by a secrets manager. That approach avoids writing the credential itself directly into an approved command.