A convenience feature in Claude Code, Anthropic's AI coding agent, has left real passwords and API keys sitting in public view on GitHub. Research published on November 5 by the security firm Apiiro found that when a developer approves a command with the option "Yes, and don't ask again," Claude Code saves that command word for word as a permission rule in a file called .claude/settings.local.json, inside the project folder. If the command contained a secret, the secret is saved with it, in plain text.
Apiiro's researchers, Shmulik Cohen and Matan Giladi, searched public GitHub repositories from November 1 to 3 and found 104,185 copies of that file across 103,617 repositories. In 1,122 of those files, about 1.1 percent, they found at least one real secret, for a total of 1,379 distinct secrets. The haul included 379 database passwords and 122 Supabase service-role keys, along with cloud keys, API tokens and SSH logins. Examples cited included a database vendor's admin-level cloud key, a production Azure Postgres password, a Square production token and the owner password for a medical-records database.
Counting older versions of the file in git history, the shared settings file that teams commit on purpose, and saved agent chat transcripts, Apiiro put the broader total at 2,539 distinct secrets in 1,994 repositories. It said 63 organizations were affected, most of them software companies, and that one company confirmed its exposed key had been live. In the median leaking repository, the file had first been committed 217 days before the researchers' November 2 snapshot, so many of these secrets have been public for months.
The file is not supposed to travel. Claude Code is designed to keep it on the developer's own machine, and the first time it writes the file inside a git repository it adds the file to the developer's global git exclude list. Apiiro's argument is that this safeguard has gaps: it is not added to the project's own .gitignore, and it can miss cases such as a folder that becomes a repository later, a clone on another computer, or a file that was committed before the safeguard applied. The researchers also traced 539 repositories to a commit co-authored by Claude that changed the file, suggesting the agent itself sometimes helps push it into version control.
Standard secret-scanning tools miss much of this. Apiiro ran two widely used scanners, gitleaks and TruffleHog, over the files it found. Gitleaks flagged 564 of the 1,122 files containing a real secret and TruffleHog flagged 643, while 215 files were flagged by neither. The blind spot is the password typed inside an ordinary command, after a database flag or inside a curl header, which does not look like a recognizable key format.
The findings come with caveats. Apiiro sells security products for coding agents, so it has a commercial interest in the problem, and it did not test any of the credentials it found. In its usage, a "real secret" means a value in a known provider format or a password sitting next to a publicly reachable host, not a credential proven to still work. No public reply from Anthropic had been reported in the days after the research appeared.
For teams using Claude Code, the steps are straightforward. Search your GitHub organization for .claude/settings.local.json and the shared .claude/settings.json, treat any secret found there as exposed and rotate it, and add the local settings file to each project's own .gitignore. Above all, be careful with the "don't ask again" option on any command carrying a credential, because approving it once can mean publishing it for everyone.