Claude Code is accidentally exposing secrets all over GitHub
Summary
Researchers at Apiiro found more than 100,000 cases where Claude Code’s local settings file appeared in public GitHub repositories. About 1,100 files from 63 organizations contained secrets, including API tokens, database passwords, and private keys; Anthropic says it is looking into ways to prevent the exposure.Key Facts
- Claude Code can save approved shell-command rules in a local file named .claude/settings.local.json.
- The settings file may include sensitive information embedded in commands.
- Anthropic’s documentation says the file is added to a developer’s global .gitignore list, but that protection may not apply at the repository level.
- Apiiro found more than 100,000 public GitHub cases involving the settings file.
- About 1,100 of the cases contained secrets and were linked to 63 organizations.
- Secrets can remain in copies of a repository, including forks, after the original file is removed.
- Claude Code team member Boris Cherny said the team was looking into ways to prevent the issue and recommended secret-scanning tools.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
