{"slug": "claude-code-is-accidentally-exposing-secrets-all-over-github", "title": "Claude Code is accidentally exposing secrets all over GitHub", "summary": "Apiiro security researchers found over 100,000 instances of Claude Code's local settings file (.claude/settings.local.json) uploaded to public GitHub repositories, about 1,100 of which — from 63 different organizations — contained secrets including API tokens, database passwords, and private keys. The leak stems from Claude Code writing approved shell commands verbatim into the settings file, which Anthropic's documentation says is added to the developer's global .gitignore but not at the repo level, so the file can be committed accidentally or by Claude Code itself without user input. Secrets can persist in forks of the original project even after the files are removed.", "body_md": "Claude Code is leaking sensitive information on public GitHub instances thanks to a partial oversight in the way its settings files are handled. That’s the finding of AI security researchers at Apiiro, who [discovered thousands of secrets](https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again), including database passwords, API tokens, and root logins, amid Claude Code settings files embedded in GitHub repositories.\n\nThe leak stems from the way Claude Code handles user approval for automated shell commands. When a user chooses the “Yes, and don’t ask again” option to approve running a command, that choice gets stored as part of a rule in the local “.claude/settings.local.json” file on the user’s computer. That rule is sometimes coded as a pattern, but the command itself is often written to that settings file as is, including any sensitive information that may be embedded within it.\n\nThis isn’t really a significant security issue if the settings file stays on the user’s local machine (assuming that machine doesn’t become compromised itself, of course). And Anthropic [notes in its Claude Code documentation](https://code.claude.com/docs/en/settings) that this particular settings file gets added to [the developer’s global .gitignore list](https://docs.github.com/en/get-started/git-basics/ignoring-files), which usually prevents it from being shared publicly.\n\nBut that .gitignore setting isn’t reflected at the repo level, meaning the sensitive file can be uploaded accidentally if a repo is cloned to another machine or a folder becomes a repo later, for instance. In many cases, Claude Code itself will commit changes to the settings file without the user’s input, Apiiro writes.\n\nApiiro’s researchers found over 100,000 cases where Claude Code’s local settings file had been uploaded to a public GitHub repository. Of these, only about 1,100 from 63 different organizations contained secrets such as public API tokens, database passwords, or private keys. Even after these files are discovered and removed from a repository, the secrets can persist in forks of the original project if a GitHub user isn’t careful.", "url": "https://wpnews.pro/news/claude-code-is-accidentally-exposing-secrets-all-over-github", "canonical_source": "https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/", "published_at": "2026-11-09 17:24:26+00:00", "updated_at": "2026-11-09 18:20:40.446816+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "ai-agents", "developer-tools"], "entities": ["Claude Code", "Anthropic", "Apiiro", "GitHub"], "also_reported_by": [{"url": "https://cryptobriefing.com/claude-code-leaks-secrets-github/", "source": "cryptobriefing.com", "title": "Claude Code leaks over 1,300 secrets into public GitHub repositories", "published_at": "2026-11-09T17:27:56+00:00"}, {"url": "https://epyhia.com/anthropic-s-claude-code-tool-leaks-thousands-of-secrets-to-public", "source": "epyhia.com", "title": "Anthropic's Claude Code Tool Leaks Thousands of Secrets to Public GitHub Repositories", "published_at": "2026-11-09T18:08:11+00:00"}], "alternates": {"html": "https://wpnews.pro/news/claude-code-is-accidentally-exposing-secrets-all-over-github", "markdown": "https://wpnews.pro/news/claude-code-is-accidentally-exposing-secrets-all-over-github.md", "text": "https://wpnews.pro/news/claude-code-is-accidentally-exposing-secrets-all-over-github.txt", "jsonld": "https://wpnews.pro/news/claude-code-is-accidentally-exposing-secrets-all-over-github.jsonld"}}