Claude Code Security Flaw Exposes Thousands of API Keys and Passwords in Public GitHub Repositories

A critical security oversight within Anthropic’s AI coding assistant, Claude Code, has resulted in the inadvertent exposure of sensitive credentials—including API keys, database passwords, and SSH tokens—across thousands of public GitHub repositories. Research conducted by the software security firm Apiiro has identified a systemic failure in how the AI tool manages user-approved shell commands, leading to the storage of plaintext secrets within project-level configuration files that are frequently pushed to version control systems.

The vulnerability centers on a specific file generated by the assistant: .claude/settings.local.json. When a user interacts with Claude Code, the assistant occasionally requests permission to execute shell commands. If a developer selects the "Yes, and don’t ask again" option, the tool logs the exact command—including any hardcoded credentials—into this local JSON file to facilitate future automation. Because this file is often committed to source control by developers or the assistant itself, these secrets are subsequently uploaded to public platforms, where they become accessible to anyone with an internet connection.

Chronology of the Vulnerability

The issue is not entirely new to the developer community, although its scale has only recently been quantified. The timeline of discovery and inaction highlights a growing friction between the convenience of AI-assisted coding and the rigorous demands of secure development lifecycles.

On August 11, 2025, a developer filed an initial bug report on the official Claude Code GitHub repository, explicitly warning that approved commands containing sensitive authentication tokens were being persisted in plaintext within the settings.local.json file. Despite the potential severity of the leak, the report languished without meaningful engagement from the project maintainers. On January 3, 2026, an automated bot shuttered the issue, citing a lack of activity over a 60-day period—a common practice in high-volume open-source projects that inadvertently led to the dismissal of a critical security concern.

By early 2026, researchers at Apiiro initiated a comprehensive audit of public GitHub data to determine if this behavior had resulted in real-world exposure. Their findings confirmed that the behavior was not merely theoretical but had already manifested in a massive leakage of corporate and personal credentials. As of the most recent reports, multiple tickets related to this vulnerability have been closed by automated systems without substantive developer intervention, raising questions about the responsiveness of AI tool providers to security-related community feedback.

Data-Driven Analysis of the Exposure

Apiiro’s audit of public repositories revealed a staggering landscape of risk. The firm scanned for the presence of .claude/settings.local.json and identified 104,185 copies of the file across 103,617 repositories. Of these, 1,122 files were confirmed to contain at least one clear-text secret, totaling 1,379 unique credentials.

The nature of these secrets poses a significant threat to organizational security. Among the findings were 379 database passwords, 43 SSH login credentials for public-facing servers, 42 authentication tokens for platforms like GitHub, GitLab, and the npm registry, and 23 Amazon Web Services (AWS) access keys. Notably, some of these exposed secrets were associated with high-stakes infrastructure, including administrative cloud keys for database vendors and passwords for sensitive medical-records databases.

The persistence of these leaks is equally concerning. Half of the repositories containing these secrets had been hosting the vulnerable files for at least 217 days. Furthermore, the practice of forking repositories compounds the problem; the researchers discovered that 211 forks across 74 distinct projects were carrying the same compromised credentials as the original source code, effectively multiplying the surface area of the attack.

Limitations of Current Security Tooling

One of the most troubling aspects of this incident is the failure of existing security scanners to detect these specific leaks. The researchers subjected the identified files to common secret-detection tools such as Gitleaks and TruffleHog. The results were suboptimal: Gitleaks identified only 564 of the 1,122 compromised files, and TruffleHog flagged 643. More than 200 files containing confirmed secrets were missed by both scanners entirely.

The reason for this detection gap lies in the nature of the data. Traditional scanners are designed to look for high-entropy strings or specific, recognizable API key formats. However, when a developer types a password directly into a command—such as mysql -p[password] or sshpass -p [password]—the resulting text string is often indistinguishable from standard command-line syntax. Because the AI assistant saves these commands verbatim, the secrets are camouflaged within functional code, allowing them to bypass automated security gates that are otherwise optimized to catch accidental commits of configuration files.

The Mechanism of Failure

Anthropic’s documentation for Claude Code notes that the assistant attempts to protect the user by adding the .claude/settings.local.json file to the user’s global git excludes. This mechanism is intended to prevent the file from being tracked by Git. However, this defense is fundamentally flawed for several reasons:

1. Local Scope: The protection is applied only to the specific user’s environment on their local machine. It does not travel with the project repository. If the project is cloned by another developer or if the user forgets to apply the global exclusion, the file is vulnerable to being committed.
2. Lack of .gitignore Integration: Claude Code does not automatically generate or update the project’s .gitignore file. If a developer performs a git add . or fails to manually update their ignore rules, the file is indexed by the version control system.
3. AI Co-Authorship: Evidence suggests that in at least 539 instances, the AI assistant itself was identified as a co-author of the commit that introduced the sensitive file, implying that the tool may be actively participating in the process of committing the very files it is supposed to be protecting.

Implications for AI-Assisted Development

This incident underscores a broader architectural challenge in the era of AI-integrated development environments (IDEs). Coding agents are designed to be autonomous and helpful, often prioritizing execution speed and "low-friction" user experiences over security-first defaults. The "don’t ask again" feature, while beneficial for productivity, essentially creates a "silent" configuration file that can quickly become a repository of sensitive session state.

The risk is not limited to cloud-based repositories. These files are also frequently bundled into Docker images, ZIP archives, and npm packages, creating secondary vectors for potential exploitation. As demonstrated by the Shai-Hulud worm in September 2025—which utilized automated scanners to harvest credentials from infected machines—malicious actors are actively scanning for these types of oversights.

Recommendations for Remediation

For developers who have utilized Claude Code, the path forward requires a transition from reactive troubleshooting to proactive credential management. Security researchers strongly advise the following steps:

• Immediate Rotation: Treat every secret found within a .claude/ directory as compromised. This includes rotating database passwords, AWS keys, API tokens, and SSH credentials. Do not rely on the assumption that a leak has not been detected by a malicious actor.
• Git History Scrubbing: Simply deleting the file is insufficient, as the credentials remain in the repository’s commit history. Developers must use tools like git filter-repo or BFG Repo-Cleaner to permanently excise these files from all branches and history.
• Audit Configuration Files: Manually inspect both .claude/settings.local.json and .claude/settings.json for any hardcoded sensitive information.
• Update Ignore Rules: Ensure that .claude/ is explicitly listed in the global .gitignore and local project .gitignore files to provide redundant protection against future commits.

For security teams and organizations, the incident highlights the need for robust AI governance. Organizations should implement strict policies regarding the use of AI coding assistants, particularly those that require shell access or generate local configuration files. Furthermore, security teams should augment standard scanning tools with custom regex patterns designed to catch credentials in command-line arguments, rather than relying solely on pre-built detection signatures.

As of the latest updates, Anthropic has faced mounting pressure to address the architectural design of Claude Code. The reliance on automated issue-closing bots has been criticized by the research community as insufficient for handling vulnerabilities of this magnitude. Until a formal patch is issued that enforces a more secure handling of shell-command history, developers are advised to treat the AI assistant as an untrusted environment for sensitive command execution, ensuring that all authentication is handled via environment variables or secret-management services rather than inline command arguments.