What Apiiro reported
On November 5, 2026 Apiiro, a company that sells application security tools, published research titled "Coding Agents Copy Your Secrets to a Hidden File. Thousands Are on GitHub". It writes: "Apiiro research found 2,539 real secrets in 1,994 public GitHub repositories: database passwords, cloud keys, API tokens, SSH root logins." The post gained wide attention on Hacker News on November 7.
Apiiro says it reported each affected organization to its owner on November 2 and 3, and that 63 organizations, mostly software companies, are affected. "One company confirmed its key had been live."
How the secret gets into the file
According to Apiiro, when Claude Code proposes a command that needs a password or token, it asks before running it. "Pick \"Yes, and don't ask again\" and it saves that exact command, secret included, to .claude/settings.local.json inside the project folder." Claude Code adds that file to the developer's global git ignore list, but "the rule never goes into the repo's own .gitignore", so a copied project folder on another machine or container without the global ignore, or a file already tracked by Git, is not covered. Once the file is committed, every clone keeps it in history. Apiiro researcher shmulc corrected on Hacker News that an earlier mention of a fresh clone as a cause was wrong.
Apiiro says "out of 104,185 public copies of this file on GitHub, 1,122 hold a real secret", and it found 1,160 more in git history, shared settings.json files and saved agent transcripts. In 539 of 1,105 traced repos, a commit co-authored by Claude changed the file. Apiiro calls this Claude Code's own behavior, reproduced with Opus 5.5 and Fable 5.1.
What is not confirmed
Apiiro states: "No credential was used or tested, and no host was contacted." A "real secret" in its count means a credential that matches a provider format or sits next to a public host, not one known to be valid. Apart from the one company that confirmed a live key, it is not known how many still work. The figures are Apiiro's and have not been independently verified.
The Apiiro study is dated November 5; the Hacker News discussion and the replies below came on November 7 and 8. Anthropic has not published an official statement or advisory that we found as of November 8. On Hacker News, Boris Cherny of the Claude Code team wrote that Claude Code has historically not done secret scrubbing and the team is looking into what it can do to prevent this. In his view the file is meant to stay local and is auto-ignored when Claude creates it, so the leaked files were manually created and checked in; he also recommends auto mode instead of allow/deny rules and secret scanning on the code host. These are his assessments, not independently verified. Apiiro says users have reported the mechanism in Claude Code GitHub issues since August 2025 without a reply from Anthropic. Apiiro also notes that common scanners missed many cases: of the 1,122 files, "gitleaks flagged 564 and TruffleHog 643; 215 were flagged by neither", mostly passwords typed inside commands.
What to do now
Search your repositories and their history for .claude/settings.local.json and .claude/settings.json. If the file is tracked, Apiiro suggests running git rm --cached on it and adding it to the repo's own .gitignore. Open the file on your machine too and delete any allow rule that contains a password, token or key, then rotate every credential it ever held, since git history, forks and clones keep old copies.
Going forward, reference secrets as environment variables such as $DB_URL instead of typing them into commands, treat agent folders like .claude/ as sensitive in the same way as .env files, and make sure your secret scanning catches passwords inside commands, not only known key formats.
Go to the source
Sources & further reading
Based on the official documentation below. Features and access can change; check the provider before making a decision.
Was this page useful?
Help us make our coverage more useful. This is feedback on the page, not a rating of the tool.
Go a little further