2,539 GitHub Secrets Exposed, Some Saved by Claude Code Settings
Apiiro found 2,539 exposed credentials across nearly 2,000 public GitHub repositories and traced part of them to Claude Code, which saves secret-bearing commands in a settings file that gets committed with the code.
⚡ Why it matters
'Yes, and don't ask again' looks harmless, but it can write your database password into a file pushed to a public repo. If you code with AI assistants, check your projects now.
How the leak happens
Ask Claude Code to query a database or call an API and it proposes a command carrying the secret from your config. Pick "Yes, and don't ask again" and the full command, credential and all, is stored in .claude/settings.local.json inside the project. Since the repo doesn't flag that file as private, it ends up in the next commit.
Claude Code does add the file to the developer's global Git ignore list, but that rule never goes into the project's own .gitignore, so it does not travel with the repo.
The numbers
- Researchers checked 104,185 public copies of the file; 1,122 held real secrets, 1,379 distinct ones in total.
- In 539 of the 1,105 repos with secrets, a commit co-authored by Claude Code touched the file.
- Among the leaked material were a live Azure Postgres password, a production token issued by Square, and the owner password for a medical-records database.
Anthropic's Claude Code lead said the company is exploring fixes, including built-in secret scanning in the next version.
What to do
- Search your projects for
.claude/settings.local.jsonand delete any rule containing a secret. - Rotate every credential that ever appeared in that file, even if it was never committed.
- Add
.claude/to each project's.gitignore. - Security teams should include AI agent folders in pre-commit and history secret scanning.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Luna Moth Hits Law Firms Again to Steal Microsoft Tokens
Extortion group Luna Moth is returning to law firms it hit before, likely those that refused to pay. This time it poses as IT support and talks employees into copying their Microsoft access token themselves, with no malware involved.
186 Fake AI Domains Spoof ChatGPT, Claude and Gemini
Island uncovered TypoPrompting, a campaign using 186 misspelled domains that impersonate 27 AI brands, including ChatGPT, Claude, Gemini, Copilot, Grok and DeepSeek, to push ClickFix lures, browser hijackers and search-hijacking extensions.
7 Ways to Avoid Fake Meeting Scams and "Audio Fix" Malware
Campaigns like FaceStealer don't exploit a bug; they talk you into downloading a "fix" during a video call. These practical steps shut this kind of attack down.