Security researchers found over a thousand Claude Code settings files on GitHub holding real passwords and keys. Teams that use the tool should check now.
A convenience button in Anthropic's AI coding assistant, Claude Code, has been saving passwords and access keys in a file that sometimes ends up public. Security company Apiiro found 1,122 publicly accessible settings files holding real credentials. Anyone who can see those files could read the secrets inside.
Claude Code can run commands on a developer's computer, such as connecting to a database. Those commands can contain passwords. Normally the tool asks permission first. Developers can pick "Yes, and don't ask again" to skip future prompts.
The catch is how it remembers that choice. Claude Code can save the whole command, password included, in a local file called .claude/settings.local.json. That file is meant to stay private, and Claude Code tries to keep it off GitHub, the site where developers store code. Those protections do not cover every case. If Git was already tracking the file, or a project was moved or set up differently, the file can be published with the code.
Apiiro's researchers looked at 104,185 public copies of the file across 103,617 GitHub repositories. About 1.1% held what they judged to be real secrets, 1,379 distinct credentials in all. A wider search, including older file versions, found 2,539 credentials across 1,994 public repositories.
The exposed credentials belonged to 63 organizations, from small teams and startups to established technology vendors. They included passwords for production databases, a cloud management key from a database provider, and credentials tied to an application that handles medical records.
Apiiro did not test whether the credentials still worked, and it did not try to log in anywhere. So it is not known how many were live or whether attackers used them. One organization did confirm that an exposed key had been active. Teams that do not use Claude Code, or that keep their code private, are not in the picture described here. Anyone who uses the tool with public repositories should check.
The alert box above lists the steps. The key point is that deleting the file is not enough. Older versions can stay in a repository's history or in copies other people made, so any password or key the file ever held should be replaced.
Boris Cherny, Anthropic's head of Claude Code, replied to the findings on Hacker News on November 7. He said the team is exploring built-in scanning for exposed credentials and extra safeguards in the tool's automated permission system. He did not give a specific fix or release date, so the risk remains for now.
If your team uses Claude Code with public GitHub repositories, look for its settings files and replace any password or key they ever held.
Disney+ is working on a free plan, more short clips and creator videos, according to a leaked internal deck. Here is what it could mean for your screen.
Read more: Disney+ plans a free tier, short videos and creator clipsDeputies in the Upstate area say scammers are calling while posing as police officers, and a scary call can cost you money or personal details.
Read more: Sheriff's deputies warn of scam calls from fake police officersA Financial Times report says a Southeast Asia data center pitch told Chinese investors getting Nvidia chips was easy. Supply claims like that deserve a hard look.
Read more: Data center pitch to Chinese investors claimed easy access to Nvidia chips
