Claude Code feature leaks secrets in public GitHub repos

The convenience trap

Anthropic recently released Claude Code, a tool designed to help developers interact with their codebases using AI. To make the experience smoother, the tool includes a 'don't ask again' feature intended to reduce what developers call 'approval fatigue.' This happens when a user is repeatedly asked for permission to run various shell commands during a session.

When a user selects the option to never ask again for a specific action, Claude Code saves an allow rule to a local file named .claude/settings.local.json. This file is stored within the project folder on the developer's machine. The goal is to streamline the workflow by remembering which commands the user has already authorized.

However, a security firm called Apiiro discovered that this process creates a significant vulnerability. If a developer types a command that includes a secret—such as a password or an API key—the tool saves the entire literal command into that JSON file. Because the file is stored in the project directory, it can be accidentally committed to public version control systems like GitHub.

Scope of the exposure

Apiiro conducted a search of public GitHub repositories and found 104,185 copies of the settings file across 103,617 different repositories. While most of these files did not contain sensitive data, the search uncovered 1,122 files that held at least one real secret. This resulted in a total of 1,379 distinct secrets being exposed to the public.

The variety of leaked credentials was extensive and included 379 database passwords, 122 Supabase service-role keys, and 23 AWS keys. The search also identified 43 SSH logins for public servers, some of which were root passwords. Additionally, the researchers found 42 tokens for platforms like GitHub, GitLab, and npm, as well as 23 AWS keys.

The impact of these leaks reached beyond individual hobbyists. The research identified 63 organizations affected by the leak, ranging from student groups to established vendors. Notable examples included a database vendor's cloud API key with management access and a software agency's production Square token. One organization even confirmed that a key found in the research was currently live.

Technical limitations of fixes

Anthropic has acknowledged the issue and is looking into potential solutions. Boris Cherny, the head of Claude Code at Anthropic, stated that the company is investigating ways to prevent this. He noted that the tool has historically not performed 'secret scrubbing,' which is the process of automatically identifying and removing sensitive information from logs or files.

The company plans to prototype several fixes, such as building in basic secret scanning or making 'auto mode' catch specific commands. However, Cherny suggested these might not fully solve the problem. He pointed out that because Claude Code automatically ignores the settings file upon creation, the exposed copies were likely created manually by users and checked into the repository by mistake.

Security researchers have noted that standard secret scanners are not a perfect solution. In testing the 1,122 files containing secrets, common tools like gitleaks and TruffleHog failed to flag 215 of them. This suggests that the way these secrets are formatted or embedded in the JSON files can sometimes bypass existing automated security checks used by repository hosts.

Mitigation and best practices

The risk posed by these files extends beyond public repositories. Because the settings file sits in plain JSON format on a developer's local machine, it remains a target for malware. For example, a known npm worm has previously hunted for similar files on victim machines to steal credentials. This means the threat is not just limited to what is visible on the internet.

Apiiro advises that simply deleting the file is not enough to secure a repository. Because Git tracks the history of all changes, the secrets remain accessible in the project's history, forks, and clones. To properly secure a compromised repository, developers are encouraged to rotate every credential that was ever stored in the file before attempting to clean up the history.

To prevent future leaks, security experts recommend several best practices for using AI coding tools. Developers should add the .claude directory to their .gitignore files to ensure it is never uploaded. They should also use environment variables to handle secrets instead of typing them directly into commands. Finally, whenever possible, users should approve general patterns of commands rather than allowing specific, literal commands that might contain unique data.