Claude Code Secrets Leak: How to Check Your GitHub Repos

The Claude Code secrets leak is a reminder that an AI coding agent's convenience features write things to disk. Research published on 5 November 2026 by the security company Apiiro found passwords and API keys sitting in public GitHub copies of a settings file used by Claude Code, Anthropic's AI coding agent. It was widely discussed on Hacker News over the weekend, and any developer can check for it in a few minutes. Here is what happened, how it works and what to do.

What happened with the Claude Code secrets leak?

Apiiro researchers Shmulik Cohen and Matan Giladi collected public GitHub data between 1 and 3 November 2026. According to reports on their findings in The Hacker News, iTWire and Daily CyberSecurity:

• They found 104,185 public copies of .claude/settings.local.json.
• 1,122 of those copies, about 1.1%, held at least one secret, for 1,379 distinct secrets.
• Those included 379 database passwords, 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys.
• Adding Git history, shared settings files and saved agent transcripts raised the total to 2,539 secrets across 1,994 repositories.
• 63 organisations were identified as owners. The worst cases included a database vendor's admin-level cloud key and the owner password for a medical-records database.

Two caveats matter. Apiiro did not test whether any secret still works, so these are classified credentials rather than confirmed live ones, although one organisation it notified confirmed its key had been live. Apiiro also sells security products, and its review used its own rules plus an AI checker, so the totals have not been independently replicated.

How does "Yes, and don't ask again" expose passwords?

A secret is any value that grants access, such as a password, token or API key. If you are fuzzy on what an API is, our restaurant-style API explainer reel covers it in 26 seconds.

An AI coding agent is a tool that plans and runs steps on your code, including shell commands. Our AI agents explainer reel shows that loop. Because those commands can do damage, Claude Code asks before running most of them.

Pick "Yes, and don't ask again" and Claude Code saves an allow rule, a line that pre-approves that command, in the project's local settings file. Anthropic's documentation describes this. Sometimes the rule is a tidy pattern such as npm test *. Sometimes it is one exact command, and then it is stored word for word.

So if you approved this once:

PGPASSWORD=real-password psql -h db.example.com -U admin

the password now lives in plain text in a JSON file inside your project folder. The file stays harmless only for as long as it stays private.

Why did these files end up on GitHub?

This part is disputed, and both sides have a point.

Anthropic's settings documentation says that the first time Claude Code writes the file in a Git repository, it adds the path to your global Git excludes file, a personal ignore list on your own machine. Boris Cherny, head of Claude Code, wrote on Hacker News that this means the exposed copies were created by hand and checked in.

The researchers and iTWire point to the limits of that protection. The ignore entry exists on one laptop and does not travel with the project the way a .gitignore does, and Git ignore rules do nothing for a file that is already tracked. Apiiro also found commits co-authored by Claude changing the file in 539 of 1,105 repositories it traced, which it reads as Claude often committing the file itself. iTWire cautions that this does not prove Claude introduced or pushed every exposed credential.

The behaviour itself was reported long before this. Issue #5544, opened on 11 August 2025, described credentials stored verbatim in this file. A bot closed it on 3 January 2026 after inactivity, which, as iTWire notes, is not evidence of a fix.

Why does it matter beyond one tool?

Scanners are tuned for key shapes. Secret scanners look for known formats, such as an AWS key prefix. Of the 1,122 files, gitleaks flagged 564 and TruffleHog flagged 643. Neither flagged 215, mostly plain passwords after PGPASSWORD=, sshpass -p or mysql -p.

Exposure lasts. When Apiiro collected its data, every file with a secret was still on its repository's default branch, and in half of those repositories it had been there for at least 217 days.

Agent folders are a new place secrets collect. Apiiro compared the documentation of 16 coding agents and says Claude Code is the only one confirmed to store the full approved command in a project file by default. Even so, it advises treating .claude/, .cursor/, .gemini/ and .specstory/ like .env files.

Where the secret can survive	Does deleting the file fix it?
Your current branch	Yes, for that branch only
Git history	No
Forks and other clones	No, Apiiro found 211 forks carrying the same secrets
npm packages, Docker images, zip files	No, each copy must be handled

What should you do about it?

Work through these in order. Run the first two inside each project where you use Claude Code.

1. See whether the files are tracked, now or ever.

   git ls-files .claude/
   git log --all --oneline -- .claude/settings.local.json .claude/settings.json
   

2. Read the file, even if it was never committed. Delete any rule containing a real value. This search is a starting point and will not catch everything:

   grep -niE 'password|passwd|token|secret|bearer|sshpass|api[_-]?key' .claude/settings.local.json
   

3. Rotate first, tidy later. If a secret was ever pushed, revoke or replace it before anything else. GitHub's guidance puts this first and says that once a secret no longer works, a history rewrite may not be needed.

4. If the file is tracked, stop tracking it, then ignore it in the repository. The ignore rule protects your teammates too:

   git rm --cached .claude/settings.local.json
   echo '.claude/settings.local.json' >> .gitignore
   

5. Keep values out of commands. Load credentials from a secrets manager and refer to them by name, so a saved rule holds $DB_URL rather than the password. Note that an inline assignment like PGPASSWORD=abc psql still puts the password in the command.

6. Approve patterns, not one-off commands, and check what you are saving before you say "don't ask again".

7. Turn on secret scanning in your Git host, and extend pre-commit checks so they catch passwords inside commands.

If you do need a history rewrite, GitHub's guide covers git-filter-repo and the side effects, including changed commit hashes and the risk that old clones bring the data back.

What is Anthropic doing? The reports we read carry no formal company statement. Cherny said the team is "looking into" prevention, with options including better auto mode checks and built-in secret scanning, to be prototyped before shipping. He also recommended auto mode over manual permission rules, and agreed with a commenter who pointed out that sensitive commands approved in auto mode could still be saved.

Disclosure: byagents builds with Claude Code, and this post was drafted with Claude, which is made by Anthropic. We checked our own repository, and it tracks no agent settings files.

Building something with AI agents and want it locked down from day one? Start a project with byagents.

Researched and drafted with AI agents by byagents, fact-checked against the sources above. Edited by Yashvanth S.