Claude Code leaks thousands of secrets to public GitHub repos

On 10 November 2026, Dark Reading reports that AI coding assistants, specifically Claude Code, have been leaking thousands of secrets to public GitHub repositories. Apiiro’s study identified 2,539 credentials exposed across nearly 2,000 public repositories, including database passwords, cloud keys, API tokens and SSH root logins.

The leaks arise from how Claude Code handles certain commands: when a user asks it to check a database or call an API, Claude Code may generate a command that includes the secret from a configuration file. If the user agrees to “Yes, and don’t ask again,” the exact command, secret included, is saved to .claude/settings.local.json within the project folder and then committed with the rest of the code. The file is not marked private in the repo, so it travels with commits and becomes visible in public copies.

Apiiro’s analysis found 104,185 publicly accessible copies of .claude/settings.local.json on GitHub, with 1,122 files containing real secrets and 1,379 distinct secrets in those files alone (636 provider-specific keys and 743 passwords or tokens for public hosts). Claude Code sometimes participated in committing these exposed files: in 539 of 1,105 repositories containing real secrets, a commit co-authored by Claude Code amended the affected settings file.

The report notes that the protection—adding the file to a user’s global Git ignore list—does not travel with the repository, leaving the secrets exposed when the project is cloned. Apiiro and Anthropic’s Boris Cherny discuss potential mitigations, including auto-detection of exposure and integrated secrets scanning, but emphasise that secret-bearing agent folders on laptops and in repositories should be treated as sensitive by security controls.