Claude Code is accidentally exposing secrets all over GitHub

Claude Code’s latest blunder is a textbook case of “nice‑to‑have” features turning into a data‑leak nightmare for anyone who ever thought a global .gitignore was a silver bullet. The AI‑powered coding assistant writes a local .claude/settings.local.json file to remember a user’s “Yes, and don’t ask again” approval for shell commands. When that file contains a raw command with embedded passwords, API keys or root credentials, and the user’s .gitignore fails to keep it out of the repo, the secret ends up on public GitHub for anyone to scrape. The fallout is not just a privacy footnote – it’s a real risk to the supply chain of every independent hosting provider that relies on clean codebases.

Why the leak matters for hosting operators

The Apiiro researchers uncovered more than 100,000 instances where Claude Code’s settings file was pushed to a public repository. While only about 1,100 of those cases actually contained secrets, those secrets included database passwords, API tokens and private keys – the exact kind of credentials that give a malicious actor unfettered access to production systems. For a hosting provider, a single leaked database password can translate into a full‑blown breach of customer data, compliance violations, and a hit to reputation that no amount of marketing can fix.

Even if the leaked file is removed promptly, the secrets can linger in forks and cached copies. That means the risk isn’t a one‑off event; it’s a persistent exposure that can be harvested by automated scrapers long after the original repo owner thinks they’ve cleaned up. In a business‑risk lens, the cost of a breach far outweighs the inconvenience of a missing .gitignore entry.

The technical root of the problem

Claude Code stores the user’s “always‑allow” rule directly in .claude/settings.local.json. When a user selects “Yes, and don’t ask again,” the command – often a raw shell string that may embed credentials – is written verbatim. Anthropic’s own docs say the file is added to a global .gitignore, but that only protects the file on the developer’s machine. If the repo is cloned elsewhere or the folder is later turned into a Git repo, the global ignore no longer applies, and Claude Code can even commit changes to the settings file without prompting the user.

This gap is a classic case of “local‑only” assumptions breaking in collaborative environments. The tool’s design never accounted for the fact that developers routinely move code between machines, share folders, or spin up new repos on the fly. When the .gitignore entry isn’t mirrored at the repo level, the safety net evaporates and the secret‑laden file sails straight into the public domain.

What the timeline tells us

The issue isn’t brand‑new. A bug report flagged the problem as far back as August 2025, and follow‑up reports noted that the settings file sometimes wasn’t added to the .gitignore at all, or that Claude Code could write sensitive commands to an unprotected file. Yet those reports were closed after 60 days of inactivity, leaving the bug unfixed for over a year. That kind of lag is typical of VC‑fueled AI startups that prioritize feature velocity over hardening security. For independent operators, it’s a reminder that relying on hype‑driven tools without a solid audit can backfire spectacularly.

The delay also underscores a broader industry pattern: security fixes get buried under a mountain of “new model releases” and “feature rollouts.” When a tool’s core workflow inherently writes secrets to disk, the problem can’t be patched with a quick config tweak – it requires a redesign of how approvals are persisted.

Anthropic’s response and its limits

In a Hacker News thread, Claude Code’s Boris Cherny acknowledged the issue, saying the team is “looking into what we can do to prevent this.” He stressed that the settings file “should pretty much never be checked in” and suggested using Claude Code’s auto mode, which routes routine permission prompts through classifiers. However, another user pointed out that even in auto mode, sensitive commands can still be saved to the settings file, prompting Cherny to call the observation a “good catch” and admit the team is still “thinking through what we can do to improve this.”

While the intent to add secret scanners into Claude Code is a step in the right direction, the Apiiro data shows that existing scanners – gitleaks and TruffleHog – missed 215 of the roughly 1,100 public secrets. That’s a non‑trivial blind spot, meaning that even a future built‑in scanner won’t guarantee full coverage. Relying on a vendor’s roadmap is a gamble; the risk remains until a concrete mitigation lands.

Practical steps for hosting providers

First, enforce a repository‑level .gitignore that explicitly excludes .claude/settings.local.json. Make it part of your CI pipeline: any commit that adds the file should fail the build. Second, integrate a secret‑scanning stage that runs both gitleaks and TruffleHog, and supplement them with a custom regex for the patterns Claude Code tends to embed (e.g., password=, api_key=). Third, educate developers that “auto mode” is not a free pass – it still writes to the same file, so the same guardrails apply.

Finally, consider a policy that disables Claude Code’s “always‑allow” shortcut in production environments. The convenience of a single‑click approval is outweighed by the risk of persisting secrets on disk. If a command truly needs to run without prompting, have it scripted in a vetted, version‑controlled playbook rather than relying on Claude Code’s ad‑hoc storage.

Broader implications for AI‑assisted development

This leak is just the latest in a string of AI agents unintentionally exposing credentials – Meta’s Muse agent had its sharing feature suspended after researchers found its URLs were guessable. The pattern is clear: AI tools that automate shell access or generate code snippets often treat secrets as first‑class data, persisting them in ways that assume a single‑user workflow. In multi‑user, cloud‑native environments, that assumption collapses.

For the hosting industry, the lesson is to treat AI‑generated artifacts with the same scrutiny we apply to any third‑party library. If a tool writes a file that could contain credentials, that file must be subject to the same audit, access controls, and secret‑management policies as any other production artifact. Otherwise you’re handing attackers a fresh vector to infiltrate your infrastructure.

Actionable takeaways for founders

1. **Audit your dev toolchain** – Identify any AI assistants that write local config or state files. Map where those files land and whether they can be inadvertently committed.

2. **Lock down .gitignore at the repo level** – Global ignores are a convenience, not a security control. Enforce repository‑wide rules via pre‑commit hooks.

3. **Implement defense‑in‑depth scanning** – Run multiple secret scanners in CI and supplement with custom patterns for AI‑generated content.

4. **Educate your team** – Make it clear that “auto mode” or “always allow” shortcuts are not a free pass. Require explicit review before persisting any command that contains credentials.

5. **Plan for vendor lag** – Expect that AI vendors will take months to ship fixes. Build your own mitigations now rather than waiting for a patch.

By treating Claude Code’s mishap as a warning sign rather than an isolated bug, independent hosting providers can shore up the weakest links in their supply chain before a breach knocks on the door.

— Allan Ali, Founder

This article was produced with AI-assisted research and editorial support. Reporting is based on the source material cited below. Sources: Ars Technica; arstechnica.com; Global1.News (09 November 2026).

By Allan Ali, Global1.News