Passwords and API keys typed into commands approved within Anthropic's Claude Code have surfaced in public GitHub repositories (The Hacker News).
Apiiro disclosed that 1,122 public copies of that settings file contain at least one secret.
According to Claude Code documentation, the configuration file applies its rules to future sessions anywhere in the repository (Claude Code Docs). Yet when exact commands are saved, any password or token typed into them remains in plain text. Apiiro’s scan of public GitHub uncovered 104,185 copies of the file across more than 100,000 repositories, with roughly 1.1 % holding secrets.
The exposed items include 379 database passwords, 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. More than a third of the secrets would grant direct database access. Affected file owners span 63 organizations, primarily software companies of varying sizes.
Claude Code tries to keep the file out of version control by adding it to the user's global git excludes the first time it writes the file in a repository. Researchers observed that Claude Code never adds the file to the project's own ignore list, and in 539 traced repositories a commit listing Claude as a co‑author altered the file.
Removing the local file does not stop existing leaks, as older versions persist in git history and forks. Security guidance advises developers to rotate every password, token and key ever stored in the file before attempting repository cleanup. One company notified by researchers confirmed that its key had been live.
The discovery of plaintext credentials inside Claude Code's auto-approval settings files highlights the inherent risks when agentic coding tools interact directly with shell environments. Because the assistant saves exact commands to streamline future developer workflows, users may inadvertently persist sensitive authentication data without realizing it is being written to disk. The reliance on global git excludes rather than explicit project-level ignore rules suggests that standard version control protections can easily fail in collaborative or automated commit scenarios, making proactive credential rotation an essential first response for affected teams.
Spotted an error? See our corrections policy or email editorial@lordofclaude.com.
Discussion & Comments (0)
Join the conversation