AI Coding Assistant Claude Code Leaks Passwords and API Keys via Settings Files on GitHub

A widespread security vulnerability involving Anthropic’s AI coding assistant, Claude Code, has exposed thousands of sensitive credentials—including database passwords, production API keys, and administrative tokens—across public software repositories on GitHub. Software security researchers at Apiiro revealed that the tool’s default permission-handling behavior inadvertently captures plaintext secrets entered by developers into interactive terminal commands and logs them into project-level configuration files that frequently end up committed to version control systems.

The flaw underscores the mounting security challenges enterprises face as autonomous coding agents, shell-execution models, and AI-driven development workflows become deeply integrated into software engineering pipelines. While coding assistants promise unprecedented productivity gains by executing terminal commands and streamlining codebase management, this incident highlights how automation can quietly bypass traditional human vigilance regarding credential hygiene and secret management.

The Mechanics of the Leak: How Claude Code Stores Secrets

At the center of the security issue is a specific configuration file generated by Anthropic’s utility: .claude/settings.local.json. Claude Code relies on shell commands to inspect, test, and build software projects. By default, the assistant prompts the developer for explicit permission before executing potentially impactful shell instructions.

When a developer interacts with these prompts, the utility offers an option labeled "Yes, and don’t ask again." Selecting this choice triggers an automated rule-saving mechanism. Claude Code records the approved command string verbatim into the .claude/settings.local.json file located inside the root directory of the local project folder. This ensures that identical operations can run seamlessly in subsequent developer sessions without repeatedly interrupting the workflow.

However, the captured commands often contain sensitive arguments supplied inline by the user. Whether a developer is initializing a database connection with an explicit password string, authenticating an SSH session, or passing a live cloud API token directly into a deployment script, the entire command line is logged in plain text.

Apiiro’s analysis demonstrated that this behavior remains active across recent model iterations, including Opus 5.5 and Fable 5.1. Although Claude Code attempts to prevent these local settings files from reaching public repositories by writing them into a user’s global git exclusion list on their local machine, this preventative measure has significant limitations. The exclusion rule is restricted to a single user workstation and does not travel with the project code. If a developer or an automated co-authoring agent commits the configuration file before global ignores take effect—or if the project is shared across collaborative environments—the file is tracked by git and subsequently pushed to remote repositories like GitHub.

Furthermore, Apiiro’s investigation revealed that in over a third of the affected repositories, a git commit listing Claude as a co-author was responsible for modifying or introducing the file, suggesting that the coding assistant itself frequently facilitates the persistence and tracking of these sensitive records.

Scale of the Exposure: Apiiro’s Findings and Data Breakdown

To quantify the scope of the vulnerability, Apiiro conducted a comprehensive automated scan of public GitHub repositories, searching specifically for instances of the exposed .claude/settings.local.json file. The findings present a sobering picture of accidental credential exposure in modern software development ecosystems.

Apiiro’s researchers identified more than 104,000 copies of the .claude/settings.local.json file spread across approximately 103,617 public repositories. Out of this vast corpus, roughly 1.1%—totaling 1,122 individual file copies—contained at least one verified secret. In total, these files harbored 1,379 unique sensitive credentials.

To validate the findings, researchers categorized a value as a secret only when it matched established cryptographic key structures, or when a clear password or token string was found in direct proximity to a public server address or authentication endpoint, backed by automated AI content verification.

The composition of the leaked secrets highlights severe organizational risks:

• Database Access: Over a third of the discovered credentials directly exposed database infrastructure, including 379 distinct database administration passwords.
• Infrastructure and Remote Access: Researchers uncovered 43 Secure Shell (SSH) login credentials for public-facing servers.
• Developer and Package Ecosystem Tokens: The dataset included 43 active tokens for platforms such as GitHub, GitLab, and the Node Package Manager (npm) registry.
• Cloud Infrastructure Keys: At least 23 Amazon Web Services (AWS) keys were identified in the public dumps.

The leak impacts organizations of all scales, ranging from independent open-source projects to commercial enterprises. Among the identified owners of compromised repositories were 63 distinct corporate entities, including prominent software vendors and medical technology providers. Notable examples highlighted by Apiiro include an exposed admin-level cloud API key belonging to a major database vendor and master ownership credentials for a medical records database.

Temporal analysis of the compromised repositories revealed a persistent danger. As of early assessments, every single file containing an active secret remained visible on the default branch of its respective repository. In half of those repositories, the compromised files had been publicly accessible for at least 217 days. Historical git branches and repository forks exacerbated the spread: older versions of the files harbored an additional 734 secrets across 509 repositories, while 211 forks of 74 distinct repositories replicated the exact same vulnerabilities.

Chronology and Prior Bug Reports

The revelation by Apiiro is not entirely unprecedented within the developer community. Concerns regarding Claude Code’s command-storage behavior have circulated in public developer forums and issue trackers for months, highlighting a critical window between initial user reporting and industry-wide security analysis.

• August 11, 2025: A formal bug report was submitted to the official Anthropics GitHub repository for Claude Code (Issue #5544), explicitly warning that approved terminal commands containing embedded API keys and authentication tokens were being written verbatim into the settings.local.json file.
• January 3, 2026: After 60 days of inactivity on the initial report, an automated repository management bot closed the ticket, categorizing it as "not planned."
• Subsequent Weeks: Multiple parallel bug reports detailing the identical credential-logging behavior were filed by developers. All related reports were similarly closed by automated repository bots without official intervention or direct commentary from Anthropic representatives at the time of closure.
• March 2026: Apiiro published its comprehensive security research, shifting the issue from an isolated community bug report to an enterprise-grade vulnerability affecting thousands of live codebases.

The handling of these early reports underscores a systemic friction in open-source AI development: the tension between rapid feature deployment and the responsiveness of automated repository moderation systems to critical security disclosures.

Limitations of Traditional Secret Scanners

One of the more alarming revelations of Apiiro’s research is the systemic failure of conventional secret-detection tools to catch credentials stored inside AI configuration files. Standard industry scanners—such as Gitleaks and TruffleHog—rely heavily on pattern matching designed to recognize specific cryptographic key formats, such as structured API tokens or randomized private keys.

When researchers tested leading open-source secret scanners against the 1,122 exposed files containing sensitive data, the tools performed poorly without manual verification steps:

• Gitleaks successfully flagged only 564 of the files.
• TruffleHog identified 643 of the files.
• 215 files containing active secrets completely bypassed both scanners.

The primary reason for these detection gaps lies in the nature of terminal commands. Passwords typed inline following standard command-line flags—such as PGPASSWORD=, mysql -p, or sshpass -p—do not conform to standard high-entropy token formats. To automated scanning algorithms, these entries resemble ordinary parameters within standard shell commands, allowing raw plaintext passwords to slip past automated continuous integration (CI) security gates undetected.

The danger extends beyond public git hosting platforms. Because .claude/settings.local.json is a plain JSON document residing within local directories, the risk profile includes local device compromise. Security analysts note that malware targeting developer environments—such as the Shai-Hulud supply-chain worm identified in late 2025, which leveraged tools like TruffleHog to harvest credentials from infected machines—could easily weaponize these unencrypted local configuration files.

Mitigation Strategies and Industry Recommendations

In response to the widespread exposure, security experts have outlined immediate remediation steps for individual developers and overarching defensive protocols for corporate security teams.

Guidance for Developers

1. Prioritize Secret Rotation: Merely deleting the .claude/settings.local.json file or scrubbing a repository’s current branch is insufficient. Because sensitive data persists in git history, commit logs, and repository forks, developers must immediately invalidate and rotate every password, token, and API key that has ever been processed or saved within their local project environments.
2. Audit Configuration Files: Engineers should inspect their local and global project directories for .claude/settings.local.json and .claude/settings.json, ensuring no sensitive shell invocations have been permanently stored in permission rules.
3. Expand Beyond Public Repositories: Developers must remember that configuration files can accidentally propagate into bundled npm packages, local Docker container images, compressed zip archives, and cloud-synced workstation folders.

Guidance for Security Teams

1. Enforce Dynamic Monitoring: Organizations should implement specialized scanning rules capable of parsing JSON configuration structures and analyzing inline shell commands within repository files, rather than relying exclusively on high-entropy token signatures.
2. Review AI Tooling Policies: Enterprises managing software development lifecycles (SDLC) must establish explicit governance frameworks regarding the deployment of AI coding assistants, particularly tools that cache interactive terminal commands or modify local build configurations without centralized oversight.
3. Continuous Secret Sweep Operations: Security operations centers (SOCs) should conduct historical git-log analyses across corporate codebases to detect historical instances of local configuration commits before they can be exploited by external actors.

As generative AI agents continue to redefine software engineering workflows, the Claude Code incident serves as a critical milestone for AI governance, emphasizing that convenience and speed must not outpace rigorous security engineering and secure-by-default architecture.