Claude Code puts secrets in 1,122 public files on GitHub

Apiiro, a software security company, tells that 1,122 public copies of one Claude Code file hold one or more secrets. Anthropic makes Claude Code, a coding tool that uses AI. The secrets are passwords, tokens and keys. Apiiro did not test if they work. One company that it told confirmed that its key was in use.

How it works

A user tells Claude Code to stop the prompts for one command. The tool then keeps the full command in the file .claude/settings.local.json. If the command has a password, the file keeps it in plain text. The tool puts the file in the ignore list of one computer only, not in the ignore list of the project.

The numbers

Apiiro found 104,185 copies of the file on public GitHub. Of these, 1,122 hold secrets, and 379 secrets are database passwords. The same 215 files had secrets that two scan tools did not find.

What is not known

Apiiro tells that a bot closed 4 related bug reports and that Anthropic gave no answer. Apiiro does not tell if a person used the secrets.

Insight: The leak stays open long but an attack is fast

In half of the repositories with a secret, the file was open for 217 days or more. Microsoft tells that since August 2026 attackers use an AI tool to find secrets in public GitHub code. In one example it went to a cloud vault in 5 minutes. The file stays open for a long time, an attack is fast, and only a fast change of keys helps.