The Claude Code secrets leak began with a single click. Security firm Apiiro said on November 5 that 1,122 public copies of a Claude Code settings file on GitHub hold real passwords, API keys and cloud credentials, and the wider sweep found 2,539 secrets across 1,994 public repositories. The credentials were not stolen by an attacker. They were saved by the tool itself, every time a developer picked “Yes, and don’t ask again” on a command that happened to carry a secret.

Apiiro, which sells security products, scanned public GitHub between November 1 and 3. The firm counted 104,185 public copies of .claude/settings.local.json in 103,617 repositories. About 1.1 percent of them held at least one real secret, a total of 1,379 distinct secrets: 636 keys in a known provider format and 743 passwords or tokens sitting next to a public host address. The broader count of 2,539 adds secrets in git history, the shared settings file and saved agent chat transcripts.

The exposed credentials are not theoretical. The finds include a database vendor’s own admin-level cloud key, a production Azure Postgres password, a Square production token and the owner password of a medical-records database. Sixty-three organizations are affected, mostly software companies, and one company told Apiiro its exposed key had been live. The firm did not test the credentials itself, so “real secret” means a value that matches a known key format or points at a public host, not one proven to work.

How one click saves a password

Claude Code asks before it runs a shell command. Ask it to check a database or call an API and the command it proposes often carries the password or token from your config file. Pick “Yes, and don’t ask again” and the tool saves that exact command as a permanent allow rule. Apiiro put it plainly: “Pick ‘Yes, and don’t ask again’ and it saves that exact command, secret included, to .claude/settings.local.json inside the project folder.” Claude Code’s own permissions documentation confirms the mechanism: “When you choose ‘Yes, and don’t ask again’ and the approval saves permanently, such as for a Bash command or a WebFetch domain, Claude Code saves the rule to .claude/settings.local.json at the root of the git repository.”

The file is supposed to stay on the developer’s machine. Claude Code’s settings documentation says the first time it writes the file in a git repository, it adds the file to the developer’s global git excludes, “so it stays out of your commits”. Apiiro says that guard covers the common case but not a folder that becomes a repository later, a clone on another computer, or a file already committed before the exclusion existed. The rule also never goes into the project’s own .gitignore, so anyone who clones the repo does not inherit the protection. In 539 of the 1,105 leaking repositories Apiiro traced, a commit co-authored by Claude itself had changed the file.

Apiiro stresses the flaw sits in the tool, not the model: “This is Claude Code’s own behavior, not the model’s.” The researchers reproduced it with Opus 5.5 and Fable 5.1, and of 16 coding agents whose documentation they compared, Claude Code was the only one confirmed to write the full approved command to a project file by default. A separate bug report says approvals sometimes land in the shared .claude/settings.json instead, a file teams commit deliberately. Apiiro found secrets in 298 of 76,011 public copies of that file.

Four steps showing how Claude Code's Don't Ask Again button leaks a secret to GitHub
Graphic: GPTOnline, based on Apiiro research

Why scanners missed so many

Standard secret scanners caught barely half the problem. Apiiro ran gitleaks and TruffleHog over all 104,185 files. Of the 1,122 files with a real secret, gitleaks flagged 564 and TruffleHog flagged 643, while 215 were flagged by neither, usually because the secret was a password typed into a command after PGPASSWORD=, sshpass -p or mysql -p rather than a key in a recognizable format.

Time made it worse. In the median leaking repository, the file was first committed 217 days before Apiiro’s November 2 snapshot, so most of these secrets have sat in public for months. Older versions in git history hold another 734 secrets across 509 repositories, usually where the file was deleted but not its history, and 211 forks carry the same secrets. Deleting the file does not clean any of that up. The file also sits in plain text on every laptop where someone clicked the button, and malware already collects credentials from developer machines in bulk.

The Claude Code secrets leak in numbers
Graphic: GPTOnline, based on Apiiro research

What to do if you are affected

Apiiro’s advice starts with rotation, not deletion. Search your GitHub organization for .claude/settings.local.json and .claude/settings.json, and check each repository’s git history even if the file is gone. Rotate every password, token and key the file has ever held, because removing the file does not clean history, forks or clones. Then untrack it with git rm --cached, add it to the project’s own .gitignore, and delete any allow rule holding a secret from the local copy, even if it was never committed. The longer term fix is to stop typing secrets into commands at all: reference them as variables such as $DB_URL and approve patterns like Bash(npm run:*) rather than literal commands.

Why it matters

Users have reported the behavior on Claude Code’s GitHub tracker since August 2025. Apiiro cites four such reports and says none received a reply from Anthropic, and three were closed automatically as inactive or duplicates. Anthropic had not commented on the research as of November 7. It is also the second privacy issue tied to Claude Code to surface this week, after reports that the tool handed users’ email addresses to websites.

The episode is a reminder that the risk in agentic coding tools is not only what the model does with a secret, but what the tooling quietly writes down. A button built to save a few clicks has been writing production passwords into files that are easy to publish, and rotation is the only reliable fix for anyone affected.

Sources