A safety prompt in Anthropic’s Claude Code is exposing passwords, keys and tokens in public GitHub repositories, according to research published by Apiiro on Nov. 5.
Before running a shell command, Claude Code asks the developer for approval. Choosing “Yes, and don’t ask again” turns the full command into a standing rule, stored in a project file called .claude/settings.local.json.
Any password or key in that command is stored with it in plain text. The repository has nothing telling git to keep the file private, so it can end up committed alongside the code.
Apiiro counted 104,185 copies of the file on public GitHub, spread across 103,617 repositories. Real secrets turned up in 1,122 of them, 1,379 distinct secrets in total.
Among the 63 affected organizations were student teams, startups, software agencies and a few established vendors. Leaked credentials included production database passwords, 43 SSH logins for public servers, and cloud and AI model keys, the kind of access attackers have hijacked and resold.
Missed by Scanners, Committed by Claude
Popular secret scanners found only some of them. Gitleaks flagged 564 of the 1,122 files and TruffleHog 643, while 215 got past both.
According to Apiiro, the tools are built to spot recognizable key formats. A password that follows PGPASSWORD= or sshpass -p blends into the rest of the command line, so it often goes unflagged.
In many cases Claude put the file in the repository itself. Apiiro traced 1,105 affected repositories and found Claude listed as co-author on a commit that changed the file in 539 of them. The model’s commit instructions steer it away from files such as .env and credentials.json, but they don’t mention its own settings file.
Removing the file later wasn’t enough either. Older versions in git history held 734 secrets, across 509 repositories, that are missing from every current copy.
Anthropic Looks at Built-In Secret Scanning
Boris Cherny, Anthropic’s head of Claude Code, wrote on Hacker News that Claude Code historically “has not done secret scrubbing,” but that the team was “looking into what we can do to prevent this.”
He listed possible fixes, including “making sure auto mode catches this, building in basic secret scanning.” When another commenter pointed out that auto mode could leak secrets the same way when it pauses on a sensitive command, he answered, “good catch.”
Developers had flagged the behavior in GitHub issues as far back as August 2025. According to Apiiro, Anthropic never answered any of them, and three were closed automatically.
Cherny also wrote that Claude Code automatically gitignores the file when it creates it, “so in this case the files were manually created and checked in.” Apiiro countered that the rule goes only into the developer’s global ignore list, not the repository’s own .gitignore. That leaves out folders turned into repositories later and copies cloned onto other machines. Expert Insights has contacted Anthropic for comment.
Apiiro’s advice to developers was to stop git from tracking the file, list it in the repository’s .gitignore and change every credential it has ever contained, because forks and clones hold copies too. It also suggested keeping secrets out of commands altogether by referring to variables such as $DB_URL.
Apiiro treated a credential as real if it followed a known provider format or appeared alongside a public host, and it didn’t check whether any of them worked. In the median affected repository, the file had first been committed 217 days before Nov. 2.
