Claude Code Spilled 2,539 Secrets Onto Public GitHub, Apiiro Finds

Security researchers at Apiiro went looking for stray credentials on GitHub and found a pile of them written by Anthropic's own coding agent. Between November 1 and November 3, 2026, the team counted 104,185 public .claude/settings.local.json files. Of those, 1,122 files — roughly 1.1% — held 1,379 distinct secrets. Once git history and other files were folded in, the tally climbed to 2,539 secrets spread across 1,994 repositories.

The mechanism is a convenience feature. When a developer picks the “Yes, and don't ask again” option, Claude Code writes an allow rule for that shell command into .claude/settings.local.json. Sometimes it saves a broad pattern, but often it stores the command exactly as typed — and developers paste credentials straight into commands. Researchers Shmulik Cohen and Matan Giladi published the findings on November 5, 2026.

The file was supposed to stay put. Apiiro says it was kept out of version control through a machine-local git exclusion rather than a standard .gitignore entry, meaning the protection lived on one laptop and never traveled with the project. Clone the repo, fork it, or set it up on a new machine, and the guardrail can disappear — leaving the next commit free to push the settings file, secrets included, into public view.

The leaked material was not throwaway test data. Apiiro flagged database passwords, API tokens and root logins, and called out Supabase service-role keys in particular because they bypass row-level security — closer to a master key than a house key. Sixty-three organizations were affected. Apiiro's advice: any credential that touched a public settings file should be treated as compromised, since deleting the file does not scrub it from git history or from forks and clones already made.

Popular secret scanners did not catch everything. Gitleaks and TruffleHog missed 215 of the 1,122 compromised files, according to the research, because credentials were often embedded inline in longer command strings — forms like PGPASSWORD= buried mid-command. Apiiro reviewed 16 coding agents in total and found Claude Code was the only one storing approved commands in project files by default; the other 15 sidestepped that particular habit.

For teams using the agent, Apiiro's checklist is concrete: confirm .claude/settings.local.json is covered by a project-level .gitignore rather than a machine-local exclusion, search existing repos and their history for the file, rotate anything exposed, and stop pasting credentials into commands an agent might remember. The scanner gap gets its own warning — with inline credentials slipping past gitleaks and TruffleHog in 215 of 1,122 cases, the researchers suggest a second layer of review for agent-generated files.