Claude Code leaked 1,379 secrets across public repositories

What did Claude Code expose?

Apiiro found 1,379 distinct secrets in 1,122 public GitHub files, including database passwords, Supabase service-role keys, SSH logins and AWS credentials. Its search covered 104,185 copies of .claude/settings.local.json across 103,617 public repositories.

Claude Code normally asks before running most shell commands. Choosing "Yes, and don't ask again" writes an allow rule to .claude/settings.local.json inside the project folder. When that rule records an exact command, Claude Code stores any secret typed into the command with it.

Apiiro reproduced the behavior with Anthropic's current Opus 5.5 and Fable 5.1 models. Apiiro classified the behavior as a property of Claude Code, not the model. The convenience option targets approval fatigue, but stores credentials in plain text.

• More than one third of the 1,122 exposed files exposed direct database access. The set included 379 database passwords and 122 Supabase service-role keys.
• The files also held 43 SSH logins for public servers, including some root passwords.
• Apiiro found 42 GitHub, GitLab and npm tokens, plus 23 AWS keys.

Adding older versions of the file, a shared settings file teams commit deliberately, and saved agent chat transcripts, the tally reached 2,539 secrets across 1,994 repositories.

Apiiro did not test whether the credentials still worked, although one notified organization confirmed its key had been live. Most exposed files belonged to individual developers, but 63 organizations were also affected, from student groups to established vendors.

Apiiro identified three affected cases among those organizations:

• A database vendor's own cloud API key carried management access.
• A software agency's production Square token was exposed.
• The owner password for a medical-records app's cloud database was exposed.

How did Anthropic respond?\n

Apiiro shared its research with Anthropic before publication. On Y Combinator's Hacker News forum, Boris Cherny, head of Claude Code at Anthropic, said: "Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this."

Cherny said the team planned to prototype making auto mode detect such commands and adding basic secret scanning. He cautioned that neither approach might fully solve the problem. When a reader noted the same exposure could occur in auto mode, he replied: "Yeah good catch." The exchange did not establish that auto mode would remove the exposure.

Cherny argued that Claude Code adds the settings file to .gitignore when created. On that basis, he said exposed copies had been created manually and checked into repositories. He recommended auto mode over permission rules, alongside secret scanning provided by GitHub and other hosting services.

Conventional scanners offered only partial protection. Among the 1,122 secret-bearing files, gitleaks flagged 564 and TruffleHog flagged 643, while 215 passed both scanners.

The risk extends beyond GitHub because the settings file remains plain JSON on developer machines. Malware has hunted such files before: the Shai-Hulud npm worm ran TruffleHog over victims' files in September 2025.

Users had reported the issue in GitHub issues since August 2025. In April, Check Point-owned Lakera found credentials in 33 such files across 30 packages published to the npm registry.

What should organizations do before cleanup?\n

Apiiro advised rotating every credential the settings file had ever held before removing it. Deleting the file alone leaves secrets in Git history, forks and clones, so cleanup cannot replace credential rotation.

• Untrack the settings file and add it to each repository's .gitignore.
• Reference secrets through environment variables instead of typing them into commands.
• Approve command patterns rather than literal commands containing embedded credentials.