Passwords and API keys from Claude Code settings ended up in public GitHub repositories

Researchers from cybersecurity company Apiiro discovered database passwords, API tokens, private keys and other confidential data in Claude Code settings files published on GitHub. The cause was how the AI tool stores permissions to run commands.

Ars Technica reports on this.

Researchers found over 100,000 instances of the local Claude Code settings file being published. Approximately 1,100 such files from 63 organizations contained secrets.

How confidential data ends up on GitHub

When a user allows Claude Code to run a command and chooses «Yes, and don’t ask again», the tool records that permission in the .claude/settings.local.json file. Sometimes the entire command is recorded there — including a password or access key if they were present in its text.

According to Anthropic’s documentation, this file is added to the global .gitignore list, which normally prevents it from being published. However, the rule is not preserved at the repository level. Because of this, the file can be accidentally committed and published, for example after moving a project to another machine.

According to Apiiro, in many cases Claude Code itself added changes to this file into commits without user involvement.

Even after removing the file from a repository, confidential data can remain in its copies — forks.

GitGuardian also checked Claude Code settings files in public GitHub repositories. It found more than 31,000 unique secrets in .claude/settings.local.json files across over 23,000 repositories. More than 5,000 of them were active at the time of discovery. Among the findings were database passwords, cloud service keys and Telegram bot tokens.

The results differ from Apiiro’s estimate due to methodology. GitGuardian tracked file publications over time, including versions that were later deleted or overwritten, and verified whether credentials still worked.

Researchers found another leakage vector — public container images on Docker Hub. They discovered 613 unique secrets from Claude Code settings files in those images, 99 of which were valid.

GitHub recommends that after a password or token is published, you should first revoke or replace it. Deleting the file does not remove already exposed data from all copies of the repository and its history. 

How the Claude Code team reacted to the GitHub leak

The issue was first reported back in August 2025. Other reports also described cases where the file was not included in the ignore list or where confidential commands were stored in another file. Those bug reports were closed after 60 days of inactivity.

Claude Code creator Borys Chernyi said developers are studying how to prevent such situations. He advised users to use secret-scanning tools and said the team is considering integrating such a check into Claude Code.

At the same time, scanners also miss some leaks. Of roughly 1,100 public secrets found by Apiiro, 215 were not flagged by two popular scanning tools — gitleaks and TruffleHog.

Read also: Anthropic limited creating copies of games in Claude Code — original games and projects in the same genre remain allowed