A security investigation has revealed that passwords, API keys and other sensitive credentials entered into Anthropic’s AI-powered coding assistant, Claude Code, have been exposed in more than 1,100 public GitHub repositories.
The exposure is linked to a feature that allows developers to approve commands by selecting the option “Yes, and don’t ask again.” Once selected, Claude Code can save the approved command word-for-word in a project settings file, potentially including passwords, access tokens and other confidential information.
Cybersecurity firm Apiiro disclosed the findings on Friday, November 6, 2026, stating that it identified 1,122 publicly accessible copies of the affected configuration file containing at least one secret. The researchers identified a total of 1,379 unique credentials, although they did not establish whether all the exposed credentials remained active.
However, one company contacted during the investigation confirmed that a key discovered in its repository was still active.
The affected file, named .claude/settings.local.json, stores command permissions within individual projects. Although Claude Code is designed to prevent the file from being committed to Git repositories, the protection does not always work as expected.
How Claude Code Exposes Sensitive Information
Claude Code normally requests permission before executing most shell commands. When developers approve a command using the “Yes, and don’t ask again” option, the application saves an approval rule in the project’s local settings file.
This allows matching commands to run automatically in subsequent sessions without requiring additional permission.
However, when developers approve an exact command containing a password, API key or authentication token, the entire command can be saved in plain text.
Researchers at Apiiro said they reproduced the behaviour using the latest models available during their investigation, including Opus 5.5 and Fable 5.1.
Although Claude Code attempts to prevent the local configuration file from entering version control, its protection relies on a global Git exclusion setting on the developer’s computer.
This means the exclusion applies only to that particular machine and does not automatically protect the project when it is transferred to another computer or shared with other developers.
The researchers also discovered that Claude Code does not automatically add the affected file to the project’s own .gitignore configuration, leaving room for accidental exposure.
In 539 out of 1,105 repositories examined, researchers found commits listing Claude as a co-author that modified the affected settings file, suggesting that the AI coding assistant may sometimes include the file in its own commits.
Apiiro Identifies Thousands of Exposed Credentials
According to the investigation, Apiiro identified 104,185 copies of .claude/settings.local.json across 103,617 public GitHub repositories.
Of these, 1,122 files, representing approximately 1.1 per cent, contained at least one exposed secret.
The investigation identified 1,379 different credentials, including database passwords, SSH login credentials, cloud access keys and authentication tokens.
More than one-third of the exposed secrets provided direct access to databases. Researchers identified 379 database passwords, 43 SSH credentials for publicly accessible servers, 42 authentication tokens associated with GitHub, GitLab and npm, as well as 23 Amazon Web Services (AWS) keys.
The investigation also identified 63 organisations whose repositories contained exposed credentials, with most belonging to software companies.
Among the more serious discoveries were an administrator-level cloud key belonging to a database vendor and the owner password of a medical records database.
Researchers warned that the exposure could create significant security risks for affected organisations, particularly where credentials provide direct access to publicly accessible systems.
The investigation further revealed that the problem extends beyond files currently available in public repositories.
Although some developers had deleted the affected configuration files, older versions remained accessible through Git history. Researchers identified an additional 734 secrets across 509 repositories that were no longer present in their current versions.
They also found that 211 forks belonging to 74 repositories contained copies of the same exposed credentials.
When older versions, shared configuration files and saved AI agent conversations were included, the researchers counted 2,539 secrets across 1,994 repositories.
Security Researchers Warn Developers to Rotate Exposed Credentials
Apiiro advised developers and organisations using Claude Code to investigate their repositories and immediately replace any credentials that may have been exposed.
The researchers recommended searching GitHub repositories for .claude/settings.local.json and .claude/settings.json, including examining historical commits to identify files that may have been deleted.
They stressed that deleting an exposed file alone would not eliminate the security risk because previously committed versions could remain accessible through repository history and forks.
Developers were therefore advised to change every password, authentication token and API key that had ever appeared in the affected files before proceeding with repository cleanup.
They also recommended removing the local settings file from Git tracking and adding it to the project’s .gitignore file to prevent future accidental commits.
Another recommendation involves avoiding the direct inclusion of passwords and other sensitive credentials in shell commands.
Instead, developers should reference environment variables connected to secure credential-management systems. For example, using a variable such as $DB_URL instead of typing an actual database password into a command can prevent the sensitive value from being stored in the saved approval rule.
Researchers also advised developers to approve command patterns rather than individual commands containing confidential information.
Traditional Secret-Scanning Tools Failed to Detect Some Exposures
The investigation raised additional concerns about the effectiveness of commonly used security scanning tools.
Apiiro tested Gitleaks and TruffleHog against the 1,122 configuration files containing exposed secrets.
Gitleaks detected 564 of the files, while TruffleHog identified 643. However, both tools failed to flag 215 files containing sensitive credentials.
According to the researchers, many of the missed exposures involved passwords embedded directly inside commands rather than credentials matching recognised API key formats.
For example, passwords included after command parameters such as PGPASSWORD=, sshpass -p and mysql -p can appear like ordinary text, making them difficult for conventional secret-detection systems to identify.
The researchers also warned that developers should not assume credentials are safe simply because their configuration files have never been uploaded to GitHub.
Such files can still find their way into npm packages, Docker images, ZIP archives and synchronised folders, potentially exposing sensitive information through other distribution channels.
Previous Reports Had Already Highlighted the Problem
The investigation also pointed to earlier complaints from Claude Code users concerning the storage of sensitive information in local configuration files.
An issue report submitted to Anthropic’s Claude Code GitHub repository on August 11, 2025, had already raised concerns that approved commands containing API keys and authentication tokens were being saved word-for-word in settings.local.json.
The report was subsequently closed automatically on January 3 after 60 days without activity and marked as “not planned.”
Apiiro said four related reports referenced in its investigation had been closed by the same automated system, with the most recent closure occurring on Friday. The researchers stated that none of the reports had received a direct response from Anthropic.
The findings highlight the growing security challenges associated with AI-powered coding assistants, particularly as developers increasingly allow automated tools to execute commands, access project environments and interact with sensitive infrastructure.
Security teams are now being advised to treat AI agent configuration folders, including .claude, .cursor, .gemini and .specstory, as potential locations for confidential information and subject them to the same security controls applied to .env files.
The researchers also recommended introducing stronger secret-scanning procedures across developers’ computers, Git repositories and continuous integration pipelines to prevent similar exposures.