International
The Morning Dev

Only the news worth knowing

‹
 
A64/100

Incident · high

Claude Code settings files leak credentials and secrets to public GitHub repositories

Tier A · Patch today – Before you go home

Who’s exposed: Developers committing Claude Code settings files with approved credential-containing commands to public GitHub

Tier A because: Core infrastructure or popular tool AND secrets exposed

Reach

Attack

Damage

Fix

Popular tool · Secrets exposed

What to do

  1. Check Claude Code settings files in your repositories for passwords, tokens and keys
  2. Rotate any credentials found in publicly committed settings files
  3. Remove exposed secrets from repository history, not only the latest commit

The Brief

  • Claude Code's "Yes, and don't ask again" option saves approved shell commands to settings files, which can contain passwords, tokens and API keys.
  • Apiiro researchers found secrets, including database passwords and API keys, in settings files on public GitHub, with 1,122 public GitHub files cited in one source.
  • The leak stems from a partial oversight in how Claude Code's settings files are handled, not from an external hack or prompt injection.

Why it matters

Developers who approved commands containing credentials may have committed those secrets to public repositories, where they can be harvested by anyone.

The checklist behind the tier

Checklist · 3 of 10 yes
YesHits tech teamsJudgment: Claude Code is a developer tool used by engineering teams.
NoCore infrastructureJudgment: a single AI coding product, not shared core infrastructure.
YesPopular toolJudgment: Claude Code is a mainstream AI coding tool used by many developers.
NoExploited in the wildSources describe accidental leaks found by researchers at Apiiro, not observed attacks.
NoPublic exploitSources describe leaked secrets in public repositories, not published exploit code or PoC.
NoRemote, no loginSources say the leak needs the user to pick 'Yes, and don't ask again' and run commands.
NoFull takeoverSources describe credential exposure, not code execution or admin takeover.
YesSecrets exposedArs Technica: Apiiro found thousands of secrets, including database passwords and API keys, exposed on GitHub.
NoSupply chainSources describe accidental leaks of secrets, not malicious code shipped through a trusted channel.
NoNo fix yetNone of the sources state that Anthropic has shipped no fix or that a fix is incomplete.

Timeline

  1. The Hacker News

    Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub

  2. Hacker News: Front Page

    Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files

  3. DEV Community articles report that Claude Code's "Don't Ask Again" leaked developers' secrets to public GitHub

  4. DEV Community: ai

    Claude Code's "Don't Ask Again" Leaked Developers' Secrets to Public GitHub — Explained Honestly

  5. DEV Community: ai

    Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files

  6. Ars Technica reports Apiiro's finding of leaked secrets in Claude Code settings files on GitHub

  7. AI - Ars Technica

    Claude Code is accidentally exposing secrets all over GitHub

  8. darkreading

    AI Coding Agents Leak Thousands of Secrets to GitHub

Full coverage · 6 sources

First seen · 6 sources · Full story page · How tiers are decided