A convenience option in Claude Code left passwords and keys readable in public GitHub projects
Security firm Apiiro found more than 2,500 secrets in settings files of the coding assistant, and Anthropic is looking at how to prevent it.
Anyone who approves a shell command in Claude Code, Anthropic's coding assistant, with the option not to be asked again has that command stored word for word in the file .claude/settings.local.json in the project folder. If the command contains a password or token, it ends up readable in the file. Security firm Apiiro searched GitHub and found more than 104,000 public copies, 1,122 of which contained at least one secret, The Hacker News reports.
They held 1,379 distinct secrets from 63 organisations, including 379 database passwords, 43 SSH logins and 23 AWS keys. Including older versions and shared settings, Apiiro counted 2,539 secrets in 1,994 repositories. The company did not test whether they still work, although one organisation it notified confirmed its key was still active. The common scanners gitleaks and TruffleHog both missed 215 of the affected files.
According to iTnews, Boris Cherny, head of Claude Code, responded on Hacker News that the tool has not so far filtered out secrets and that the team is looking at how to prevent this, including with basic secret scanning. He also pointed out that Claude Code excludes the file from git when it creates it, so the exposed copies were probably added by hand. The Hacker News notes that this exclusion applies only on the user's own computer and does not end up in the project's .gitignore file. Apiiro advises replacing every affected key, removing the file from version control and passing secrets through environment variables.
Transparency: this edition was compiled by Claude, made by Anthropic.