Claude Code leaks over 1,300 secrets into public GitHub repositories

Anthropic’s AI coding agent has been quietly writing passwords into a file that was never supposed to leave a developer’s laptop. Thousands of those files ended up on public GitHub anyway.

Security researchers at Apiiro found database passwords, API tokens and root logins sitting inside Claude Code settings files embedded in public repositories. The culprit is a convenience button that turns out to be less convenient for anyone whose credentials are now visible to strangers.

How a helpful shortcut became a leak

Apiiro researchers Shmulik Cohen and Matan Giladi published the findings on November 5, 2026. The problem centers on how Claude Code remembers which shell commands a user has approved.

When a developer picks the “Yes, and don’t ask again” option, Claude Code saves an allow rule to a file called .claude/settings.local.json. Sometimes that rule is stored as a general pattern. Often, though, the full command is saved exactly as typed.

That matters because developers frequently paste credentials directly into commands. Claude Code copies the whole thing, password included, into its settings.

The file is meant to stay local. According to the researchers, it was excluded from version control through a machine-local git exclusion mechanism instead of a standard .gitignore entry. Put simply, the “do not upload” note lived on one computer and did not travel with the project.

So when someone cloned the repo, forked it, or set it up on a fresh machine, that protection could vanish. The next commit could push the settings file, secrets and all, to a public repository.

The numbers behind the exposure

Apiiro scanned GitHub between November 1 and November 3, 2026. The team found 104,185 public .claude/settings.local.json files.

Of those, 1,122 files, roughly 1.1%, contained 1,379 distinct secrets. Including git history and other files, the count rose to 2,539 secrets across 1,994 repositories.

The haul was not trivial test data. Apiiro’s breakdown of exposed items included:

• 379 database passwords
• 122 Supabase service-role keys
• 103 Supabase account tokens
• 43 SSH logins, some of them root
• 23 AWS keys
• Additional Google API keys and other provider tokens

Supabase service-role keys deserve a special mention. They are designed to bypass row-level security, which makes them closer to a master key than a regular house key.

The researchers said 63 organizations were affected.

Why standard tools missed it

Many teams lean on automated secret scanners to catch exactly this kind of mistake. Popular options include gitleaks and TruffleHog.

Those tools missed 215 of the 1,122 compromised files, per Apiiro. The reason is formatting: passwords were often embedded inline, in forms like PGPASSWORD= within a longer command string.

A design choice that stood out

Apiiro reviewed 16 coding agents as part of the research. According to the findings, Claude Code was the only one that stores approved commands in project files by default.

What this means for teams using AI coding agents

Any credential that appeared in a public settings file should be treated as compromised, since deleting the file does not remove it from git history or from forks and clones that already copied it.

Teams can check whether .claude/settings.local.json is covered by a project-level .gitignore, not just a machine-local exclusion. They can search existing repos and their history for the file, rotate anything exposed, and stop pasting credentials directly into commands an agent might remember.

The scanner blind spot deserves attention too. If inline credentials can slip past gitleaks and TruffleHog in about 215 of 1,122 cases, teams relying solely on those tools may want a second layer of review for agent-generated files.

Fifteen of the 16 agents Apiiro reviewed avoided this particular default. Developers comparing assistants now have one more question to ask: not just how smart the tool is, but where it writes down what it learns.