Thousands of developers have been unknowingly sharing their most sensitive credentials with the entire internet, and the culprit is a behavior buried inside one of the most popular AI coding tools available from Anthropic Claude.

Security researchers have traced the problem back to a specific feature of Claude Code, and the scale of what has already been exposed is significant.

Claude Code Accidentally Exposes Secrets in GitHub

Security researchers at Apiiro discovered thousands of sensitive credentials exposed in public GitHub repositories, with the leaks traced directly to a configuration file created by Anthropic’s Claude Code. The file at the center of the issue is .claude/settings.local.json, a local settings file that Claude Code uses to store a list of shell commands a developer has approved for the tool to run without asking for permission each time.

Apiiro found more than 104,000 copies of this settings file sitting in public GitHub repositories. Of those, 1,122 contained real, active secrets. By examining Git history and other related files, the researchers identified 2,539 distinct credentials spread across nearly 2,000 repositories. The affected credentials included database passwords, cloud service API tokens, private SSH credentials, and cloud infrastructure access keys. Some of the exposed repositories belonged to companies, including software developers and service providers.

The scale of the exposure was not trivial. Even the files that have been crawled and indexed by GitHub’s own search and by third-party secret scanning services represent just the accessible surface. Credentials embedded within Git history, which persists even after files are deleted from the main branch, can remain retrievable for anyone who knows where to look.

Passwords, API Keys, and More Exposed by Claude

The specific mechanism behind the leak comes down to how Claude Code handles its “Yes, and don’t ask again” feature. When a developer approves a shell command using that option, Claude Code writes the full text of that command into the .claude/settings.local.json file so that it does not need to ask for approval again the next time the same command runs. If that shell command contains a password, an API token, or any other credential as part of its syntax, that credential is written directly into the settings file in plain text.

Claude Code is designed to prevent this file from being uploaded to public repositories. When a new project is initialized, the tool adds the settings file to the user’s global Git ignore list, which signals to Git that the file should not be tracked or committed. The problem is that this protection is not airtight. If a developer clones a project onto a different machine, or converts an existing folder into a Git repository after Claude Code has already created the settings file, the ignore rule may not carry over.

In some cases, Apiiro found that Claude Code itself had committed changes to the settings file.

The result is a situation where thousands of developers who believed their credentials were safely local have inadvertently published them to the world. Many of those developers may have no idea it happened.

Anthropic Explains What Causes This Issue

Boris Cherny, the head of Claude Code at Anthropic, confirmed the company is aware of the issue and is evaluating changes to prevent it from recurring. Cherny told Apiiro that the team is considering two main options: adding built-in secret scanning that would catch credentials before they are written to the settings file and reworking how the tool handles command permissions to avoid storing sensitive command strings in a file that could be committed.

In the meantime, Cherny advised developers to use third-party security scanners and to verify that their local settings files have not been accidentally added to any repositories.

The challenge is that existing automated tools are not catching everything. Apiiro found that two widely used secrets scanners, Gitleaks and TruffleHog, failed to flag 215 of the 1,122 files that the researchers confirmed contained active secrets. The tools struggled in particular with passwords embedded within longer shell command strings, where the credential is not immediately recognizable as a secret without interpreting the broader command context.

Anthropic has not released a formal patch or a new version of Claude Code that resolves the behavior as of the reporting date. The company said it will share more details as its review progresses.

Frequently Asked Questions

What Is Claude Code?

Claude Code is Anthropic’s AI-powered agentic coding tool, designed to help developers write, debug, refactor, and manage code directly within their development environment. It is available as a command-line interface and integrates with editors including VS Code and JetBrains IDEs. Unlike a standard AI code completion tool, Claude Code is built to take actions autonomously, running shell commands, editing files, searching codebases, and managing multi-step development tasks without requiring the developer to manually execute each step.

When a developer approves a shell command for the tool to run, they can choose to approve it once or permanently, and the permanent approval is what creates the settings file at the center of this issue. Claude Code is accessible through the Claude Pro, Max, Team, and API subscription tiers.

What Is GitHub?

GitHub is a web-based platform for version control and collaborative software development, owned by Microsoft. It uses Git, an open-source version control system, to allow developers to track changes to their code over time, collaborate with others on shared codebases, and maintain a complete history of every change ever made to a project. Public repositories on GitHub are visible to anyone on the internet, which is what makes the accidental uploading of a secrets-containing file so serious.

When a file containing a password or API key is committed to a public GitHub repository, that credential becomes accessible to anyone who visits the repository, searches GitHub, or runs automated tools designed to scan public repositories for exposed credentials. GitHub does operate its own secret scanning service and alerts developers when it detects common credential patterns, but that system did not catch all of the files Apiiro identified.

Is This a New Security Issue?

The specific behavior that caused this exposure, writing approved shell commands including their embedded credentials into a local settings file, is not a newly introduced bug but rather a consequence of how the “Yes, and don’t ask again” feature was designed to work from the outset. The issue was not widely known until Apiiro’s research surfaced it in November 2026.

However, it is worth noting that this is not Claude Code’s only recent security incident. Separate reports in October 2026 documented a tampered Claude Code extension for the Cursor editor that planted an SSH backdoor in developers’ systems, as well as fake Claude download pages on claude.ai being used to steal passwords and cryptocurrency. The settings file exposure is a distinct and unrelated issue from those incidents, but its timing adds to a period of heightened security scrutiny around AI coding tools more broadly.

Has Anthropic Developed a Fix for Security Issue?

As of the November 9, 2026, reporting, Anthropic has not released a fix. Boris Cherny confirmed the company is evaluating two potential approaches: implementing built-in secret scanning to detect and redact credentials before they are written to the settings file and redesigning how command permissions are stored to avoid persisting sensitive strings at all.

For developers currently using Claude Code, the recommended immediate steps are to check whether the .claude/settings.local.json file has been committed to any public repositories, remove the file from those repositories and their Git history, and immediately rotate any passwords, API keys, or tokens that may have been included in approved shell commands. Deleting the file from the repository’s main branch alone is not sufficient, because the credential may remain visible in the repository’s Git history and in any forks that were created before the file was removed.