Security · High impactFan score 63 · Tier A
Claude Code is accidentally exposing secrets all over GitHub
Ars Technica · By Kyle Orland ·
The Brief
- Apiiro researchers found thousands of secrets, including database passwords and API keys, exposed on public GitHub repositories.
- The exposure stems from a partial oversight in how Claude Code handles its settings files.
- Ars Technica reported the findings on 2026-11-09.
Why it matters
Developers who commit Claude Code settings files to public repositories may have credentials such as database passwords and API keys publicly visible, so those repositories should be checked.
Who’s affected
- Developers using Claude Code
- Teams that commit Claude Code settings files to public GitHub repositories
What to do
- Check public GitHub repositories for committed Claude Code settings files and remove any secrets they contain.
- Rotate any credentials that may have been exposed, such as database passwords and API keys.
Claude Code is leaking sensitive information on public GitHub instances thanks to a partial oversight in the way its settings files are handled. That's the finding of AI security researchers at Apiiro, who discovered thousands of secrets , including database passwords, API…
Timeline
Ars Technica reports Apiiro's finding of thousands of exposed secrets on public GitHub
AI - Ars Technica
Claude Code is accidentally exposing secrets all over GitHub