Claude Code leaks developer secrets in public GitHub repositories

The 'Don't Ask Again' Vulnerability

Security firm Apiiro recently identified a significant security flaw in Claude Code, a tool from Anthropic designed to help developers write and manage software. The problem centers on a specific user convenience feature intended to reduce 'approval fatigue,' which is the exhaustion caused by repeatedly granting permissions to an AI. When a user selects 'Yes, and don't ask again' for a command, the tool saves an allow rule to a local file.

This rule is stored in a file named .claude/settings.local.json within the project folder. However, if a developer types a secret directly into a command, that secret is saved in the JSON file alongside the permission rule. Because the file is stored in plain text, any sensitive information included in the command becomes visible to anyone who can access the file.

Apiiro's research showed that this behavior is a property of the Claude Code tool itself rather than the underlying AI models. The firm reproduced the issue using both Anthropic's Opus 5.5 and Fable 5.1 models. The discovery suggests that the tool's design prioritizes ease of use over the secure handling of sensitive credentials.

Scope of the Data Leak

The scale of the exposure is substantial, with Apiiro finding 104,185 copies of the settings file across 103,617 public GitHub repositories. Out of these, 1,122 files contained at least one real secret, totaling 1,379 distinct pieces of sensitive information. These secrets included database passwords, Supabase service-role keys, and various tokens for platforms like GitHub, GitLab, and npm.

The haul also included 43 SSH logins for public servers, some of which were root passwords, and 23 AWS keys. More than one-third of the exposed files provided direct access to databases, including 379 database passwords. When including older versions of the file and shared settings files, the total number of secrets reached 2,539 across 1,994 repositories.

While many of the exposed files belonged to individual developers, the leak also affected 63 different organizations. These ranged from student groups to established vendors. Notable examples of affected entities included a database vendor's cloud API key with management access and a software agency's production Square token.

Limitations of Security Tools

The research also highlighted how difficult it can be for standard security software to catch these types of leaks. Apiiro tested the exposed files against two popular secret scanners: gitleaks and TruffleHog. While these tools flagged many of the secrets, 215 of the secrets found in the 1,122 files slipped past both scanners entirely.

This suggests that conventional scanners offer only patchy protection against credentials leaked in this specific way. Because the secrets are tucked into a JSON file rather than a standard configuration file, they may not trigger the alerts that many security teams rely on. This leaves a window of opportunity for malicious actors to find and exploit exposed keys.

The risk extends beyond public repositories because the file sits in plain JSON format on the developer's local machine. Malware has previously targeted such files; for example, the Shai-Hulud npm worm used TruffleHog to hunt for secrets in September 2025. This means that even if a file is not public, it remains a target for local system infections.

Anthropic's Response and Fixes

Anthropic acknowledged the issue following a report on the Hacker News forum. Boris Cherny, the head of Claude Code at Anthropic, stated that the company is looking into the problem. He noted that while the tool has not historically performed secret scrubbing, the team is exploring ways to prevent these types of exposures in the future.

Proposed solutions include building in basic secret scanning and creating an 'auto mode' that can catch commands containing secrets. However, Cherny noted that these fixes might not fully solve the problem. He argued that because Claude Code automatically ignores the settings file during creation, the exposed copies were likely created manually and checked into the repository by users.

Cherny recommended that users prefer 'auto mode' over individual permission rules and utilize the secret scanning tools provided by GitHub and other hosts. He also suggested that developers should be cautious about how they interact with the tool. Apiiro, meanwhile, advised that any credential ever held in such a file must be rotated because deleting the file does not remove the secret from the git history.