Claude Code Leaking Secrets Across Nearly Two Thousand Public GitHub Repositories
Do Son 
Large allowlists drive the rate. One in ten files over 8 KB holds a real secret, against fewer than one in 500 under 500 bytes. The longer a developer has been clicking “don’t ask again”, the more the file holds.
TL;DR
Security researchers discovered Claude Code leaking secrets across 1,994 public GitHub repositories. When developers select “Yes, and don’t ask again” during a coding session, the tool writes the exact command and any embedded password into a local configuration file. Consequently, thousands of developers have accidentally committed these hidden allowlist files to public repositories.
What was exposed
Between November 1 and November 3, 2026, Apiiro researchers Shmulik Cohen and Matan Giladi scanned 104,185 public copies of the configuration file on GitHub. They uncovered 1,379 distinct secrets sitting on default branches across 1,122 active files. Furthermore, when the team analyzed git history, shared settings files, and agent chat transcripts, the total exposure reached 2,539 real secrets across 1,994 repositories.
Specifically, the exposed credentials include 398 service API tokens, 379 database passwords, and 149 AI model API keys. In addition, the files contained 122 Supabase service-role keys, 110 Google API keys, 103 Supabase account tokens, and 43 SSH server logins. Among the most severe findings were a database vendor’s admin-level cloud key, a Square production token, and the owner password for a medical-records database.
Verified vs. unverified credentials
To respect legal boundaries, the researchers did not test any credentials or contact any hosts. Instead, they defined a real secret as a credential matching a known provider format or a password paired with a public host after filtering out placeholders and expired tokens. Following notifications on November 2 and November 3, 2026, one affected organization confirmed its exposed key was live.
How it happened
The GitHub settings.local.json exposure stems from how the coding agent remembers command permissions. When a developer asks the agent to query a database or call an API, the tool proposes a shell command that pulls credentials from local configuration files. As the report explains, “Pick ‘Yes, and don’t ask again’ and it saves that exact command, secret included, to .claude/settings.local.json inside the project folder.”
Although the tool adds this file to the developer’s global git ignore list, that protection fails if a folder becomes a repository later or gets cloned to another machine. Because the rule never enters the project’s own .gitignore file, developers and the agent itself frequently commit the file by mistake. In fact, commits co-authored by Claude modified the secret-bearing file in 539 of the 1,105 traced repositories.
Why secret scanners miss the leak
Traditional security tools struggle to detect this specific pattern of Claude Code leaking secrets. When researchers ran gitleaks and TruffleHog against the 1,122 exposed files, both tools completely missed 215 of them. Because scanners look for structured API key prefixes, they often ignore ordinary passwords typed inside PGPASSWORD, sshpass, or curl headers.
Who is affected
This exposure directly impacts 63 identified organizations, ranging from B2B startups and payments companies to universities and established software vendors. Beyond GitHub, the researchers also spotted exposed configuration files on Hugging Face Spaces and GitLab. Prior independent research reinforces the scope of this systemic issue. For instance, ironPeak found secrets in 2.4% of repositories containing AI configuration folders in February 2026, while Lakera identified credentials across 30 npm packages in April 2026. Moreover, local developer laptops remain vulnerable to credential-stealing malware like the September 2025 Shai-Hulud npm worm.
What affected people should do
Developers and security teams must take immediate steps to remediate the GitHub settings.local.json exposure. First, search your repositories and local machines for .claude/settings.local.json and .claude/settings.json. As the authors advise, “Found something: rotate first, clean up second.” Simply deleting the file will not erase the secret from git history, clones, or the 211 public forks identified in the study.
Next, untrack the file using git rm –cached and add agent configuration folders to your repository’s .gitignore template. Developers should also reference credentials as environment variables like $DB_URL rather than typing raw passwords into commands. Finally, security teams must update pre-commit scanners to detect inline command passwords alongside standard provider tokens.
Company response
Apiiro notified all 63 affected organizations on November 2 and November 3, 2026, so they could revoke their compromised keys. Meanwhile, the underlying software behavior in Anthropic’s coding tool remains unchanged across models up to Opus 5.5. According to the researchers, “Claude Code users have reported the mechanism in GitHub issues since August 2025 (#5544, #11982, #13106, #91270). None got a reply from Anthropic, and three were closed automatically as inactive or duplicate.”
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
