# Claude Code is accidentally exposing secrets all over GitHub

Source: [AI - Ars Technica](https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/) · 2026-11-09 · AI
Page: https://themorning.dev/story/claude-code-is-accidentally-exposing-secrets-all-over-github-4065836ff3f518ca
Kind: security · Impact: high

## In brief

- Apiiro researchers found thousands of secrets, including database passwords and API keys, exposed on public GitHub repositories.
- The exposure stems from a partial oversight in how Claude Code handles its settings files.
- Ars Technica reported the findings on 2026-11-09.

## Why it matters

Developers who commit Claude Code settings files to public repositories may have credentials such as database passwords and API keys publicly visible, so those repositories should be checked.

## What to do

- Check public GitHub repositories for committed Claude Code settings files and remove any secrets they contain.
- Rotate any credentials that may have been exposed, such as database passwords and API keys.

## Timeline

- 2026-11-09: Ars Technica reports Apiiro's finding of thousands of exposed secrets on public GitHub

## Coverage

- [Claude Code is accidentally exposing secrets all over GitHub](https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/) — AI - Ars Technica, 2026-11-09

Tags: claude-code, github, secrets, data-leak, security

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev