Newshot Claude Code Uploaded 2,539 Real Credentials to GitHub, With Authorization Logging Gaps as the Main Cause
Researchers found that when Claude Code records authorization for automatically executed commands, it may write passwords, tokens, and keys into local settings along with it; the files then reach public repositories due to Git configuration or automatic commits. Based on this, the research team identified 2,539 real credentials, and Anthropic is studying preventive measures.
- 2,539 real credentials identified
In public Claude Code settings, Git history, and chat logs, the security firm Apiiro identified 2,539 real credentials that can pass authentication, involving 1,994 code repositories and 63 organizations. The leak does not start with a single mistaken upload: when a user clicks "Yes, and don't ask again," the passwords, tokens, and private keys in the command are written into local settings along with the authorization record, and then carried into public repositories by Git commits. The few pop-ups saved come at the cost of long-lived keys.
2,539 real credentials flowed into public repositories
In public Claude Code settings, Git history, and chat logs, Apiiro found real credentials that can be used for authentication.
Researchers at the security firm Apiiro cross-checked public Claude Code local settings files, Git history, shared settings files, and agent chat logs. They identified 2,539 real credentials, involving 1,994 code repositories and 63 organizations. These passwords, tokens, or keys allow outsiders to pass authentication; they are not ordinary strings in files that merely look like passwords.
The list covers student teams, startups, software agencies, and established vendors. Public repositories contained Azure database passwords, Square production tokens, SSH root login information, and the owner password of a medical records database. The same settings file, the same stretch of Git history, or the same chat log may leave multiple secrets behind, so the number of credentials cannot be directly equated with the number of leaked files.
These files should have stayed local, but were later uploaded to GitHub along with the passwords and tokens in the original command text. Once version control (the system that records every change to a file) takes in sensitive information, deleting the file later does not mean the secret has disappeared.
One confirmation may bury a long-term key
Claude Code saves the long-term execution permission granted by the user together with the secrets in the command. Skipping the confirmation box also adds another path to a public repository.
Claude Code is an AI coding agent (a software agent that performs development tasks on a person's behalf) launched by Anthropic. Before running Shell commands (the operating system command interpreter), users can click "Yes, and don't ask again" to let similar commands skip confirmation in the future.
This authorization is written into the project's local .claude/settings.local.json. The full allowed command may also be saved to disk, including passwords, tokens, or keys on the command line.
Among more than 100,000 Claude Code local settings files uploaded to public repositories, Apiiro researchers found about 1,100 containing secrets such as database passwords, API Tokens (access credentials for calling external services), private keys, or root login information.
The proportion is close to one percent. The sample comes from already-uploaded public settings files and cannot directly represent all Claude Code users.
.gitignore (the rules specifying which files Git should not track) may not necessarily cover it either. This settings file is supposed to be added to global ignore rules by design, but global rules do not necessarily apply to a specific repository.
If the code is cloned to another computer, or an ordinary folder is only later initialized as a Git repository, the original protection may fail. The research also states that Claude Code sometimes commits changes to the settings file without user confirmation, and "local memory" also becomes a public record with a single push.
Deleting the file does not equal stopping the damage. If others have already created forks (copied versions of the repository), the key may remain in copies and history. Authorization records accumulated over years can also string together several secrets that should have stayed only in the terminal. Personal practice projects, small studios, and temporary repositories may also lack dedicated people to check ignore rules and commit history.
Clicking confirm once now carries an extra meaning: the user saves a few pop-ups, but the agent may retain execution permission for a long time and save the original command text containing secrets. Boris Cherny, a member of the official team, said the team is studying preventive measures and is also considering building secret scanning into Claude Code. The issue is still being handled, and the security team had previously found related signs.
The last roughly 6 minutes are for members.
The free portion ends here. Behind the wall there is also:
Behind the wall highlight: You think you are just clicking "allow" a few less times, but you may be pushing secrets into a public repository along with it.