AI Coding Assistant Claude Code Leaks Passwords and API Keys Into Public GitHub Repositories

A widespread software security vulnerability has exposed thousands of sensitive credentials, including enterprise database passwords, cloud infrastructure keys, and developer authentication tokens, through the automated operations of Anthropic’s AI coding assistant, Claude Code. According to findings published by software security firm Apiiro, user-approved shell commands containing plain-text secrets have been persistently saved into local configuration files and inadvertently pushed to public repositories on GitHub.

The security flaw highlights the growing, often overlooked attack surface introduced by autonomous AI agents in software development pipelines. As development teams increasingly delegate terminal operations, code reviews, and environment setups to large language models, the boundary between local machine state management and global version control systems has blurred with severe consequences.

The Mechanics of the Leak: How Claude Code Stores Secrets

The exposure stems from how Claude Code manages user permissions and shell execution. By default, the AI assistant prompts developers for confirmation before running most shell commands. When a developer selects the prompt option reading "Yes, and don’t ask again," Claude Code saves an automated allow-rule inside a project-specific settings file located at .claude/settings.local.json.

This functionality is designed to streamline development workflows by allowing matching commands to execute automatically in subsequent sessions without constantly interrupting the user. However, the software saves these rules verbatim—capturing the exact string entered by the developer. If a developer types a command containing an explicit password, database connection string, or API token—such as an environment variable assignment or a command-line database login—that sensitive string is written directly in plain text to the local JSON configuration file.

Although Claude Code implements a safeguard to prevent this file from being pushed to version control, the protection mechanism has notable limitations. Upon creating the file within a Git repository for the first time, Claude Code attempts to add it to the user’s global Git excludes file on their local machine. Consequently, Git ignores the file on that specific developer workstation.

However, this protection fails to travel with the project repository. It does nothing to prevent the file from being committed if global excludes are misconfigured or overridden, nor does it secure files that were already committed or shared across team environments. Apiiro’s researchers discovered that in roughly half of the affected repositories, a Git commit listing Claude itself as a co-author had modified the configuration file, indicating that the AI tool frequently commits the files directly during its automated workflows. Furthermore, deleting the configuration file from a project does not purge historical data; previous versions persist indefinitely within the repository’s Git history and any public forks.

Apiiro Research Findings and Scope of Exposure

Apiiro’s comprehensive analysis of public GitHub repositories revealed a massive scale of accidental data exposure. Researchers scanned public code repositories and identified over 104,000 copies of the .claude/settings.local.json file across more than 103,000 repositories. Out of these files, approximately 1.1 percent—totaling 1,122 configuration files—contained at least one valid or functional secret, aggregating to 1,379 distinct sensitive credentials.

The leaked data spans a wide array of high-value targets. Over a third of the uncovered secrets grant direct access to backend data systems, including 379 plain-text database passwords. Additional compromised credentials include 43 Secure Shell (SSH) login credentials for public-facing servers, 42 authentication tokens for platforms like GitHub, GitLab, and npm, and 23 Amazon Web Services (AWS) administration and access keys.

The scope of affected entities encompasses at least 63 distinct organizations, ranging from early-stage startups to major enterprise software vendors. Among the most critical discoveries were administrative-level cloud infrastructure keys belonging to a prominent database vendor, as well as master access passwords for a sensitive medical-records database.

Temporal analysis of the exposed repositories revealed that the problem is deeply entrenched. As of the disclosure date, every file containing active secrets remained present on the default branches of their respective repositories. In nearly half of those cases, the vulnerable files had been publicly accessible for at least 217 days. Beyond current repository branches, older iterations of the files preserved an additional 734 secrets across 509 repositories that had been ostensibly cleaned or modified. Furthermore, repository forks amplified the exposure, with 211 forks across 74 repositories carrying identical secrets. Shared project configuration files, such as .claude/settings.json, added another 298 secrets to the tally, bringing the grand total to 2,539 exposed secrets spread across 1,994 unique repositories.

Industry Comparison and Uniqueness of the Flaw

When Apiiro researchers compared Claude Code against 15 other prominent AI coding assistants and agentic development tools, they found that Claude Code is currently the only platform confirmed to store full, literal approved shell commands containing user-typed parameters directly in project-level configuration files by default.

Other market offerings typically log abstract command patterns, abstract out variable inputs, or store operational metadata in isolated, non-project directories that are structurally shielded from version control systems. This architectural design choice by Anthropic placed the burden of secret hygiene entirely upon the end user’s manual terminal input habits, a strategy that ultimately failed under real-world development pressures.

Detection Challenges and Downstream Supply Chain Risks

Identifying these leaks presents a significant challenge for modern security operations centers (SOCs) and automated software composition analysis (SCA) tools. Standard secret-scanning utilities—such as Gitleaks and TruffleHog—frequently miss credentials stored within these configuration files. When researchers tested popular scanners against the dataset without verification modules, Gitleaks flagged only 564 of the 1,122 vulnerable files, while TruffleHog identified 643. Alarmingly, 215 of the files containing secrets were completely overlooked by both tools.

The discrepancy arises because traditional scanners are engineered to recognize high-entropy strings or standardized formatting for API keys, such as specific AWS or GitHub token prefixes. Conversely, passwords passed directly into shell commands via standard command-line flags—such as PGPASSWORD=, sshpass -p, or mysql -p—blend seamlessly into normal operational text. To automated regex patterns, these credentials resemble ordinary words within standard shell syntax.

Beyond public repository exposure, the presence of these files creates localized supply chain risks. Because .claude/settings.local.json is a plain text file residing directly within project directories, it can easily be bundled into published npm packages, Docker container images, compressed ZIP archives, or synchronized cloud folders.

Malware targeting developer endpoints has increasingly weaponized this oversight. In September 2025, the discovery of the "Shai-Hulud" malicious npm worm highlighted the imminent danger; the worm executed automated secret-scanning routines across compromised workstations and flagged more than half of all developer machine files containing locally cached credentials.

Timeline and Disclosure History

The security implications of Claude Code’s command-saving behavior are not entirely new to the development community. Public awareness of the issue dates back several months, punctuated by official bug reports that languished without developer engagement.

• August 11, 2025: The first formal bug report regarding Claude Code storing full commands with API keys and tokens in settings.local.json was submitted to Anthropic’s public GitHub repository (Issue #5544).
• January 3, 2026: An automated project management bot closed the initial bug report as "not planned" after 60 days of inactivity, a standard lifecycle policy for unresponsive issues.
• March 2026: Apiiro publicly disclosed the comprehensive scope of the vulnerability after identifying over 1,100 public repositories leaking active database credentials and cloud tokens. Multiple subsequent bug reports addressing the same underlying behavior were similarly closed by automated bots without direct commentary from Anthropic representatives.

Mitigation Strategies and Remediation Recommendations

Security researchers and incident responders have urged immediate, decisive action for organizations utilizing AI coding assistants. Because simply deleting the local settings file or purging it from a repository does not invalidate previously exposed credentials, a strict remediation protocol is mandatory:

1. Immediate Credential Rotation: Developers and system administrators must immediately rotate all passwords, API keys, SSH keys, and authentication tokens that have ever been typed into terminal sessions managed by Claude Code. Revoking and replacing these secrets must take precedence over repository cleanup.
2. Repository Hygiene and History Scrubbing: Teams must audit project repositories for .claude/settings.local.json and .claude/settings.json files. If found, organizations must use advanced history-rewriting utilities, such as git-filter-repo or BFG Repo-Cleaner, to purge all traces of the files from past commits, branches, and associated forks.
3. Enhanced Global Exclusions: Developers should verify that global Git exclusion rules (core.excludesFile) correctly ignore local Claude configuration files across all local development environments.
4. Security Team Visibility: Enterprise security units should implement custom regex patterns in internal static application security testing (SAST) pipelines specifically designed to flag .claude/ configuration files and inline shell parameter passwords, bridging the detection gaps left by traditional secret scanners.