Secrets typed into commands approved in Claude Code are now sitting in project settings files on public GitHub. Apiiro counted 1,122 copies holding at least one credential, and one notified company confirmed its key was live.
How a password ends up in a committed file
Anthropic’s coding agent asks before running most shell commands by default. Choose “Yes, and don’t ask again” and the rule lands in .claude/settings.local.json. Sometimes that rule is a broad pattern, sometimes the exact command, password or token included, in plain text.
Claude Code normally adds the file to the computer’s global git excludes on first write. That guard lives in one user’s settings on one machine, does nothing for a file already committed, and never reaches the project’s .gitignore, so forks inherit the exposure.
What Apiiro counted
The firm found 104,185 copies across 103,617 repositories. About 1.1 percent carried a secret, 1,379 in all. More than a third open a database directly, including 379 database passwords, plus 43 SSH logins, 42 code-hosting and npm tokens and 23 AWS keys. Older revisions hold 734 more in 509 repositories.
Owners include 63 organizations, mostly software companies. The worst finds: an admin-level cloud key from a database vendor and the owner password of a medical-records database.
What defenders should do first
Rotate before cleaning up. Deleting the file does not recall it from git history or from anyone who cloned it, so treat every password, token and key it ever held as burned, internet-facing credentials first. Add the path to organization-wide .gitignore templates.
Of 16 coding agents compared, Claude Code is the only one confirmed to store the full approved command in a project file by default. Four earlier bug reports were closed by an automated bot, none with an Anthropic reply.
