Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. Security company Apiiro published the research on November 5, 2026. It found 1,122 public copies of one Claude Code settings file holding at least one secret.
The cause is not an attack. It is a normal approval click. When Claude Code asks to run a shell command and the user picks “Yes, and don’t ask again,” the tool can save that exact command as an allow rule. If the command held a password or a token, the secret is saved with it, in plain text.
The Announcement
Claude Code is the coding agent from Anthropic that runs in the terminal. By default it asks before it runs most shell commands. Its permissions documentation says the “don’t ask again” choice saves an allow rule in .claude/settings.local.json inside the project, so matching commands can run without asking in later sessions.
Sometimes that rule is a pattern, such as a test command. Sometimes it is one exact command. Apiiro says that second case is the problem, because the saved rule holds the command word for word. A database password typed after a flag, or a token placed in a command line, goes into the file unchanged.
The tool does try to keep the file out of git. Its settings documentation says the first time it writes the file in a git repository, it adds the file path to the global git excludes file for that user. That guard lives in one user account on one computer. It does not travel with the project, and it does nothing for a file that was already committed. Apiiro also notes that Claude Code never adds the file to the project level ignore file itself.
In 539 of the 1,105 leaking repositories the researchers traced, a commit that listed Claude as a co author changed the file. That suggests the agent often took part in committing the very file that held the secret. Apiiro says it reproduced the saving behaviour with Opus 5.5 and Fable 5.1, and that the behaviour belongs to Claude Code itself, not to the model behind it.
The scale problem in one picture: the secret is not in one file, it is in history, forks, and copies. Illustration: Dirty Static
What the Scan Found
Apiiro collected public GitHub data from November 1 to November 3, 2026. A value counted as a secret when it matched a known key format, or when a password or token sat beside the address of a public server, with an AI reviewer also agreeing. That method matters. Apiiro did not test the credentials, so the count shows exposure, not proven misuse. The researchers do not say whether anyone has used these secrets.
The strongest cases are still stark. They include a database vendor admin level cloud key, a production Azure Postgres password, a Square production token, and the owner password for a database that held medical records, per Apiiro. In total, 63 organisations are affected, most of them software companies.
Secrets in the 1,122 current files, by type
Counts reported by Apiiro, published November 5, 2026. Types overlap with the wider total of 1,379 distinct secrets in those files.
Age makes the finding worse. As of the snapshot on November 2, every file with a secret was still on the default branch of its repository. In half of those repositories, the file had been there for at least 217 days. Older versions held 734 more secrets across 509 repositories, usually in files that had since been deleted from the current copy.
Counting those older versions, plus secrets in the shared .claude/settings.json file and in saved agent chat logs, Apiiro puts the total at 2,539 secrets across 1,994 repositories. Forks spread some of it further, with 211 forks of 74 repositories carrying the same secrets as the originals.
Important Details
| Fact | What Apiiro reported |
|---|---|
| Public copies scanned | 104,185 files in 103,617 repositories |
| Current files with a secret | 1,122 files, about 1.1 percent |
| Distinct secrets in those files | 1,379 |
| Wider total with history and other files | 2,539 secrets in 1,994 repositories |
| Organisations affected | 63 |
| Credentials tested by Apiiro | None |
| Confirmed live key | One, reported by a notified company |
Normal secret scanners missed a large share. Apiiro ran gitleaks and TruffleHog over the copies. Gitleaks flagged 564 of the 1,122 files and TruffleHog flagged 643, while 215 were flagged by neither. The misses make sense once you see the shape. Scanners hunt for known key formats. A plain password inside a normal command line can look like an ordinary word.
We have covered the wider hygiene problem around coding agents before, in Remove Postman, Plugins, Hooks in Codex and Claude Code and in Run Claude Code, Codex and OpenCode With Corgi. This case is narrower and sharper. The risky file is not a plugin or a hook. It is the permission record the tool writes for you.
What to Do First
Apiiro gives a clear order, and the order matters. Rotate first. Change every password, token, and key the file has ever held, before you clean the repository. A secret that sat in public history should be treated as public, even if the current file looks clean.
Next, search your GitHub organisation for .claude/settings.local.json and .claude/settings.json, and check git history as well as current files. Stop tracking the local file, add it to the ignore file for the repository itself, and open the copy on your own machine to delete any rule that holds a secret.
Then change the habit that fed the leak. Keep secrets out of command lines and refer to them through variables from a secrets manager, so a saved rule holds a variable name and not a value. Approve patterns where you can, instead of one exact command that happens to carry a credential.
What’s Next
Users reported this behaviour long before the scan. A bug report filed on August 11, 2025 said approved commands with API keys and tokens were being stored word for word in the same file. Apiiro cites four related reports and says none got a reply from Anthropic, and that the four have now been closed by the same automated bot, the most recent one this week.
That history is the part Anthropic still has to answer. Facts checked on November 8, 2026: no public reply from Anthropic and no change to the documentation on this point had been reported in the coverage above. A safer default would redact secrets from saved rules, or refuse to save a command that looks like it holds one. Until that ships, the guard is yours, and it starts with a search of your own repositories today.
Sources
- Apiiro research, “Coding agents leaking secrets on GitHub,” published November 5, 2026: https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again
- The Hacker News, “Claude Code’s ‘Don’t Ask Again’ File Exposes Passwords and Keys in 1,122 Public Copies on GitHub,” November 2026: https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html
- Claude Code permissions and settings documentation, linked from the reporting above: https://code.claude.com/docs/en/permissions
Body illustration: Dirty Static. Hero image: Dirty Static.
END OF TRANSMISSION
Stay curious. Question everything.
