Claude Code Leaks Secrets and Passwords in Public GitHub Repositories

Researchers at Apiiro found that Claude Code had leaked 2,539 secrets in 1,994 public GitHub repositories including database passwords, cloud keys, API tokens, SSH root logins.

The issue rests when you ask Claude Code to access a database or call an API that requires a secret.

The popup it presents you, "Yes, and don't ask again," saves the command to .claude/settings.local.json inside your project folder, including the secret itself, leaking it publicly unbeknownst to the user.

They were able to reproduce the behavior in the latest models, Opus 5.5 and Fable 5.1, as well.

The file is meant to stay on the developer’s machine, and Claude Code tries to keep it there. When it creates the file inside a git repo, it adds it to the developer's global git ignore list. That covers the common case. It doesn’t cover a folder that becomes a repo later, a clone on another machine, or a file someone already committed. The rule never goes into the repo's own .gitignore, so nothing travels with the project to protect it.

Claude also likes to commit the file itself:

Claude Code’s commit instructions tell the model not to commit .env or credentials.json. Its own settings file is not on that list.

The affected organizations "range from student and hackathon groups to startups, software agencies and IT services firms."

The passwords leaked include for sensitive medical records databases and SSH logins for a university.

Even if the files don't leave developer machines, they're still not safe. The secrets are stored in plain JSON in the same file path in ever project, one file search away for any malware that happens to be running on the system.

Anthropic's head of Claude Code responded, saying they are "looking into what we can do to prevent this."

There’s a few possible approaches: making sure auto mode catches this, building in basic secret scanning, a few other ideas. Going to prototype a few of these to understand the tradeoffs better before we ship something.

Yesterday, I covered a vulnerability in ChatGPT that would allow attackers to exfiltrate chat history due to them weakening the iframe sandbox in their client using the allow-popups-to-escape-sandbox option.

Meta earlier this year had an incident where an agent instructed an engineer to perform actions that leaked sensitive data to employees.