Apiiro Finds Thousands of Secrets Exposed in Public GitHub Repositories

Summary

Apiiro found 2,539 credentials across nearly 2,000 public GitHub repositories and linked some exposures to Claude Code saving approved commands with secrets in a project settings file. Anthropic says it is exploring safeguards.

Key points

Apiiro reported finding 2,539 credentials across nearly 2,000 public GitHub repositories, including database passwords, cloud keys, API tokens and SSH root logins.
In the Claude Code case, choosing “Yes, and don't ask again” can save a command containing a secret in .claude/settings.local.json.
Apiiro examined 104,185 publicly accessible copies of that file and found 1,122 containing real secrets.
The file’s Git ignore protection is stored in a developer’s global settings, not the project’s .gitignore, so it does not travel with the repository.
In 539 of 1,105 investigated repositories containing real secrets, Apiiro found a commit co-authored by Claude Code that modified the affected settings file.
Anthropic said it was exploring options such as secrets scanning and changes to auto mode; Apiiro recommends rotating exposed credentials and scanning agent files and repository history.

Article Details

Event Type: Apiiro-reported exposure of credentials in public GitHub repositories, linked in part to Claude Code saving secrets in project configuration files that can be committed.
Impact: Apiiro reported finding 2,539 credentials across nearly 2,000 public repositories. In its examination of 104,185 publicly accessible copies of .claude/settings.local.json, it found 1,122 files containing real secrets and identified 1,379 distinct secrets. The exposed information reportedly included passwords, cloud keys, API tokens, and SSH root logins.

People

Boris ChernyAnthropic's head of Claude Code who said the company was considering ways to prevent the reported secrets exposure and would prototype possible approaches.Matan GiladiApiiro researcher who co-authored the report describing credentials exposed in public repositories and how Claude Code could save secrets in project configuration files.Ryan McCurdyLiquibase vice president of marketing who commented on the credential-exposure risk arising when AI coding agents retain credentials in commands.Seemant SehgalBreachLock founder and CEO who commented on the risk that developers may not realize credentials are being written into files that secret scanners might not check.Shmulik CohenApiiro researcher who co-authored the report describing credentials exposed in public repositories and how Claude Code could save secrets in project configuration files.

Vendors

AnthropicApiiro contacted Anthropic about the issue before publishing the findings. After their publication, Boris Cherny, Anthropic's head of Claude Code, said in public comments that although Claude Code historically has not

Products

Claude Codeexposed data, according to a recent report published online. Apiiro tracked some of the leaked data to Claude Code, which was, unbeknownst to users, copying secrets to a hidden file and committing them with the rest of GitHubAI coding assistants may inadvertently be leaking thousands of secrets to GitHub public repositories, making what seem like routine interactions between developers and these tools a gaping enterprise security risk.