On November 9, Ars Technica reported on research by security firm Apiiro: the AI coding agent Claude Code writes developers' passwords and API keys in plaintext into project settings files, some of which were then published to public GitHub repositories. Scanning GitHub from November 1 to 3, the researchers found 1,122 files containing real secrets among more than 100,000 public settings files; counting repository history and chat records, the total reaches 2,539 real credentials across 1,994 repositories.
Claude Code asks permission before running a shell command, and if the user picks 'Yes, and don't ask again', the approval rule is written into the project's .claude/settings.local.json together with the command itself, so any password, token or key in the command ends up in plaintext in the project folder. Claude Code adds the file to the developer's global git exclusion list when it first writes it, but that protection does not always hold: if a project is cloned onto another machine, or an ordinary folder is later turned into a repository, the file can be committed by mistake; the research also says Claude Code sometimes commits settings-file changes without confirmation, and once someone has forked a repository, the secret survives even after the original repository deletes the file.
The 1,122 files with secrets hold 1,379 distinct secrets in total, including 379 database passwords, 43 SSH logins, 42 GitHub, GitLab and npm tokens and 23 AWS keys; the most serious case is an admin-level cloud key belonging to a database vendor. Sixty-three organizations are affected, and Apiiro notified those it could identify on November 2 and 3, one of which confirmed its flagged key was still live. The research has limits, though: Apiiro did not try to use the credentials, and the total of 2,539 rests partly on an LLM reviewer's judgment rather than manual verification of each item.
This is not the first time the risk has surfaced: as early as August 2025, someone filed a similar report with Claude Code's public issue tracker, which was later auto-closed after 60 days of inactivity. Claude Code lead Boris Cherny responded on November 7 that the team is studying preventive measures and considering built-in secret scanning, but as of November 8, Anthropic had announced no fix or timeline. Common scanners are no guaranteed safety net either: 215 files with secrets evaded both gitleaks and TruffleHog. Developers using Claude Code should check their repositories and git history for .claude/settings.local.json, .claude/settings.json and saved agent chat records, and rotate any leaked key as soon as one is found; the safest habit is never to hand a command containing a password to 'don't ask again'.
