Apiiro finds Claude Code secrets exposed in 1,994 repositories

Apiiro researchers Shmulik Cohen and Matan Giladi found that Claude Code leaked secrets across 1,994 public GitHub repositories after developers opted “Yes, and don’t ask again” during coding sessions. The tool writes the exact shell command and any embedded password into a local configuration file named settings.local.json, which is then added to the project and can be committed to public repositories despite a gitignore rule.

In total, the researchers identified 2,539 real secrets across 1,994 repositories, with 1,379 distinct secrets on default branches across 1,122 active files. Exposed credentials include 398 service API tokens, 379 database passwords, and 149 AI model API keys, along with 122 Supabase service-role keys, 110 Google API keys, 103 Supabase account tokens and 43 SSH server logins.

Among the most severe findings were a database vendor’s admin-level cloud key, a Square production token, and an owner password for a medical-records database. The analysis involved examining Git history, shared settings files and agent transcripts; researchers did not test credentials or contact hosts, to respect legal boundaries, instead defining “real secrets” by provider format or password with a public host.

The exposure was measured between 1 and 3 November 2026, with notifications issued on 2–3 November. Affected organisations number 63, including startups, payments firms, universities and software vendors; beyond GitHub, exposure was seen on Hugging Face Spaces and GitLab. The report notes that some credential scanners failed to detect these leaks, with tools like gitleaks and TruffleHog missing 215 of the 1,122 exposed files.

Apiiro has told the 63 organisations to revoke compromised keys, and Anthropic stated that Claude’s underlying behaviour remains unchanged through models up to Opus 5.5. The authors emphasise remediations such as searching for settings.local.json and turning credentials into environment variables, alongside updating pre-commit scanners to catch inline passwords.