Follow us on Google News
A security investigation has uncovered thousands of exposed passwords, API keys and other credentials in public GitHub repositories linked to Anthropic’s AI coding assistant, Claude Code. Cybersecurity firm Apiiro identified 1,122 publicly accessible copies of a Claude Code configuration file containing at least one secret, raising concerns about how the tool stores approved commands.
According to research published by Apiiro, the exposure stems from Claude Code’s “Yes, and don’t ask again” permission option, which can save entire shell commands in plaintext, including passwords and authentication tokens entered by developers.
The researchers identified 2,539 exposed secrets across 1,994 repositories when current configuration files, historical versions and saved agent conversations were included. They did not verify whether all the credentials remained active, although one notified company confirmed that an exposed key had been live.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
How Claude Code’s Permission Setting Exposes Credentials
Claude Code normally requests user approval before executing certain shell commands. When developers select “Yes, and don’t ask again,” the tool saves an approval rule in a project configuration file named .claude/settings.local.json.
According to Apiiro, some approval rules preserve the complete command rather than a general permission pattern. If a command contains a password, API key or authentication token, that information can also be stored in plaintext.
Claude Code attempts to prevent the local settings file from being committed to Git repositories by adding it to the user’s global Git exclusion settings. However, this protection applies only to the individual computer and does not automatically extend to other developers working on the same project.
The researchers found that the file could still enter public repositories, including through automated commits. In 539 of 1,105 repositories examined, commits identifying Claude as a co-author had modified the configuration file.
An earlier GitHub bug report, filed on August 11, 2025, had raised concerns about approved commands containing credentials being stored without sanitisation.
Researchers Find 1,379 Secrets in Public Configuration Files
Apiiro examined 104,185 copies of .claude/settings.local.json across 103,617 public GitHub repositories. Of these, 1,122 files, approximately 1.1%, contained at least one suspected secret.
The affected files collectively exposed 1,379 distinct credentials, including 379 database passwords, 43 SSH login credentials, 42 tokens associated with GitHub, GitLab and npm, and 23 AWS keys.
The researchers identified affected files belonging to 63 organisations, primarily software companies. Among the more sensitive findings were an administrative cloud key belonging to a database vendor and an owner-level password associated with a medical records database.
The exposure was not limited to files currently visible in repositories. Investigators identified another 734 secrets in historical versions across 509 repositories, while 211 forks of 74 repositories contained credentials also present in the original projects.
Researchers also found secrets in shared Claude Code settings files. Including historical records and saved agent conversations, the investigation identified 2,539 secrets across 1,994 repositories.
The study further found that conventional secret-scanning tools missed some exposures. Of the 1,122 files containing suspected credentials, Gitleaks detected 564 and TruffleHog identified 643, while 215 files were missed by both tools.
Security Researchers Urge Developers to Rotate Exposed Keys
Apiiro warned that removing exposed configuration files from public repositories does not necessarily eliminate the risk because credentials may remain accessible through Git history, repository forks or archived copies.
The researchers advised developers to replace potentially compromised passwords, API keys and authentication tokens before removing sensitive information from repositories.
They also recommended excluding .claude/settings.local.json through repository-level .gitignore rules, examining historical commits and avoiding the inclusion of credentials directly in shell commands.
Instead, developers were advised to use environment variables or secret-management systems so that approval rules store references to credentials rather than the sensitive values themselves.
Security teams were also urged to extend credential scanning to AI coding assistant configuration folders, including those associated with Claude Code, Cursor and Gemini.
According to Apiiro, earlier GitHub reports documenting the behaviour had been closed by an automated bot without a response from Anthropic. The researchers said they found no confirmed evidence that the exposed credentials had been exploited.
The findings highlight a security risk in AI-assisted development, where commands approved for convenience can inadvertently preserve sensitive credentials in files that may later become publicly accessible.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
