Apiiro finds Claude Code credentials exposed in 1,122 public GitHub repositories

Apiiro reported on November 5, 2026, that Anthropic’s Claude Code saves approved shell commands containing passwords and API keys into.claude/settings.local.json when a user chooses Yes, and don’t ask again, and that 1,122 public copies of the file were on GitHub.

Claude Code asks before running most shell commands by default, Apiiro said. Choosing Yes, and don’t ask again turns the choice into a standing allow rule stored in the project’s local settings file. When the prompt offers one exact command, Claude Code saves any password or token typed into it in plain text in that rule.

Apiiro examined 104,185 public copies of.claude/settings.local.json across 103,617 repositories. The 1,122 exposed copies represent about 1.1 percent of the files found.

More than a third of the exposed secrets provide direct database access, Apiiro found, including 379 database passwords. The files also held 43 SSH (Secure Shell) logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. Strong exposures included a database vendor’s admin-level cloud key and the owner password of a medical-records database.

Apiiro found exposed credentials including a production Azure PostgreSQL password, a Square production token, 122 Supabase service-role keys, 103 Supabase account tokens and six private keys. Some exposed SSH commands contained root passwords.

On November 2, 2026, all files containing a secret remained on the default branch of their repositories, Apiiro found, and in half of those repositories the file had been there for at least 217 days. Forks spread the exposure further, with 211 forks of 74 repositories carrying the same secrets as the originals. Older versions of the file hold 734 secrets across 509 repositories that do not appear in any current copy.

When Claude Code first writes the file inside a git repository, it adds the file to the user’s global git excludes. That safeguard covers only one computer and does not apply to files already under version control or to folders converted into repositories afterward. Claude Code never adds the file to the project’s own.gitignore, so the safeguard does not move with the project.

In 539 of 1,105 traced repositories, commits listing Claude as co-author changed the settings file. Researchers take that to mean Claude often commits the file itself, though it does not establish Claude introduced or pushed every exposed credential. Researchers reproduced the behavior with Anthropic‘s Opus 5.5 and Fable 5.1 models.

Apiiro found that across the 1,122 exposed files, gitleaks found 564 secrets and TruffleHog found 643, with 215 missed by both scanners. Secret scanners look for known key formats, so a password that follows PGPASSWORD=, sshpass -p or mysql -p can look like an ordinary command-line word. Passwords inside request headers often miss the clear patterns that identify provider-issued keys.

Users have reported this mechanism in GitHub issues since August 2025, and Apiiro said none of those reports drew a reply from Anthropic and three were closed automatically. A bug report filed August 11, 2025, said approved commands with API keys and tokens were saved exactly as entered in the settings file; it was automatically closed as not planned on January 3. On November 6, the same bot had closed all four related reports cited by the researchers, and Anthropic did not respond to any of them. Anthropic’s response to this research has not been reported.

Apiiro did not test whether any of the exposed secrets still work, and researchers say they do not know if anyone has used these secrets. Apiiro counts a value as real when it matches a provider’s format or points to a public host, even if no one has proved it works. Researchers used none of the found credentials and contacted no host.

Researchers advise rotating every password, token and key the file has ever held before cleaning up. Teams should look through their GitHub organization for.claude/settings.local.json and.claude/settings.json and inspect the git history of each repository even after teams delete the files. Researchers say teams should rotate exposed credentials before removing files or cleaning up history.

To stop tracking the local file, teams can run git rm –cached.claude/settings.local.json and then add it to the project’s.gitignore. Researchers also say developers should open the file locally, even when it was never committed, and delete every rule that contains a secret.

Researchers said developers should keep secrets out of commands by using variables from a secrets manager like $DB_URL, so the rule stores the variable name instead of the secret. The researchers advise approving command patterns rather than individual commands, for example Bash(npm run:*). Researchers said security teams should review allow rules for passwords, tokens, connection strings and authorization headers.

Researchers said security teams should add.claude/settings.local.json to the organization’s.gitignore templates. They said teams should treat agent folders including.claude/,.cursor/,.gemini/ and.specstory/, plus agent memory files, as secret stores on laptops and in repositories, just like.env files. These folders should be added to pre-commit and CI secret scanning, including git history, and scanners should be set to catch passwords inside commands rather than only known key formats. Researchers said credentials paired with a public server should be checked first, since those provide access.

Apiiro compared documentation for 16 coding agents and found that Claude Code alone saves an entire approved command in a project settings file by default. Past Claude Code configuration issues involved attackers altering project settings to steal API keys, but this finding involves secrets captured during legitimate work. The issue arises from an ordinary authorized workflow, not a hostile prompt.

Because the company sells application and agent security products, readers should read its figures as the company’s own findings. Shmulik Cohen and Matan Giladi published Apiiro’s research on November 5. Apiiro collected public GitHub data between November 1 and 3, 2026, and notified affected organizations on November 2 and 3, 2026. One company Apiiro notified earlier in the week confirmed its exposed key had been live.

The researchers also found secrets in 298 of 76,011 copies of the shared.claude/settings.json file, a file teams commit intentionally inside allow rules. Apiiro also found secrets in saved agent conversations, memory files, and deployment notes. Files that never reach GitHub can still leak secrets, since the plain JSON file may sit inside an npm package, a Docker image, a zip archive or a synced folder.

Apiiro found real secrets in about one of every ten files over 8 KB, compared with fewer than one of 500 files under 500 bytes. In 118 repositories, someone committed the file more than a year before November 2, 2026.

In February 2026, security firm ironPeak reported finding a committed Claude settings file containing approved commands with database passwords and API keys, and it published a tool to scan AI configuration files and their history for secrets. Those reports support the mechanism described by Apiiro but do not independently verify Apiiro’s new repository totals.