Anthropic evaluates Claude Code safeguards after researchers discover exposed credentials on GitHub

Anthropic's Claude Code coding assistant has exposed thousands of credentials across public GitHub repositories, according to security researchers at Apiiro. The firm uncovered more than 104,000 copies of the tool's local configuration file on GitHub, identifying 1,122 files that contained actual secrets alongside 2,539 distinct credentials spread over nearly 2,000 repositories. Exposed data included cloud service keys, API tokens, database passwords, and private SSH credentials belonging to companies and service providers. [1][2]

The leak occurs when developers select "Yes, and don't ask again" to approve automated shell commands. Claude Code saves permitted actions directly into a ".claude/settings.local.json" file, copying entire commands alongside any plain-text tokens or passwords they contain. Although Anthropic designs the tool to add the file to the user's global Git ignore list, that safeguard often fails when repositories are cloned onto new machines or folders are later converted into Git projects. In some instances, Claude Code committed changes to the file on its own. [1][2]

Standard defenses have struggled to surface the problem; Apiiro noted that popular scanning utilities Gitleaks and TruffleHog failed to detect 215 of the 1,122 compromised files. Boris Cherny, the head of Claude Code, said Anthropic is exploring built-in secret scanning and adjustments to how permissions are stored. For now, researchers urge developers to check their public repositories, purge committed settings files from their Git histories, and immediately rotate any potentially compromised keys. [1]