Anthropic is exploring new safeguards for Claude Code after research from Apiiro found thousands of credentials in public GitHub repositories containing settings files created by the AI coding assistant.
Boris Cherny, Anthropic’s head of Claude Code, said in a public Hacker News discussion that the team is looking at ways to prevent the exposure and plans to prototype checks to catch sensitive commands in auto mode, along with basic secret scanning.
Apiiro’s research, first published on November 5 and updated on November 8, found that 1,122 of 104,185 public copies of .claude/settings.local.json on GitHub contained at least one secret. Its broader count, which includes older versions, shared settings files and saved agent records, reached 2,539 secrets across 1,994 repositories. The researchers said 63 organizations held at least one exposed credential.
The exposure can happen when a developer approves a command with Claude Code’s “Yes, and don’t ask again” option. The tool stores the approved command in .claude/settings.local.json; if the command contains a password, token or connection string, it can be saved in plain text. Anthropic’s documentation says Claude Code adds the file to a user’s global Git excludes when it creates it, but the protection does not apply to files already tracked by Git or to files created manually. Apiiro found that 539 of 1,105 repositories it traced had a commit co-authored by Claude that changed the file.
The exposed material included 379 database passwords, 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. Apiiro said one company it notified confirmed that one of its keys had been live. The researchers did not test whether all the other credentials remained valid, and they found that 215 files containing secrets were not flagged by either Gitleaks or TruffleHog during their scans.
In the Hacker News discussion, Cherny said Claude Code has not historically performed secret scrubbing. He said the team is considering ways to catch sensitive commands in auto mode and add basic secret scanning, but did not give a release date. He also said the local settings file is intended to stay on the developer’s machine and that Claude Code automatically excludes it from Git when it creates the file.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The findings are distinct from another Claude Code privacy issue involving the possible exposure of signed-in users’ email addresses in HTTP User-Agent headers, and from attacks that used stolen GitHub tokens and cloud credentials to hijack AI services.
