Security · High impactFan score 64 · Tier A7 sources1 comments in the community

$1.5T Valuation, Zero .gitignore: How Claude Code Leaked 2,539 Live Secrets to GitHub

The Brief · written from 7 sources

Apiiro researchers found that Claude Code leaks sensitive data to public GitHub repositories because of a partial oversight in how its settings files are handled.
They found thousands of secrets, including database passwords.
Dark Reading reports that a Claude Code command inadvertently saves files containing credentials to public Git repositories.

Why it matters

Developers who use Claude Code may have credentials committed to public GitHub repositories without realising it, which can expose databases and services to attackers.

Who’s affected

Developers using Claude Code
Teams that push repositories to public GitHub

What to do

Check public repositories for committed Claude Code settings files and remove any credentials they contain.
Rotate any secrets or database passwords that may have been exposed.

Anthropic is preparing for a $1.5T IPO while its flagship coding agent, Claude Code, casually dumped 2,539 live developer secrets across 1,994 public GitHub repositories. The mechanism is almost too absurd to be angry at. When an engineer runs a database or API command in the…

Read the full story at dev.to ↗