Claude Code is leaking sensitive information on public GitHub repositories due to a flaw in how the tool manages local configuration settings, based on information published by Ars Technica.
Researchers at Apiiro discovered that Claude Code stores user-approved shell commands in a local settings file. When users select the option to automate future approvals, the tool saves these commands—which often contain database passwords, API tokens and root logins—directly into the file. While Anthropic documentation suggests these files should be ignored by version control, the settings are not automatically excluded at the repository level. This oversight leads to accidental uploads when developers clone projects or initialize new repositories. Apiiro identified over 100,000 instances of these files on public GitHub, with 1,100 containing active credentials across 63 organizations. Although the issue was reported as early as August 2025, many bug reports were closed without resolution. Anthropic representatives are currently investigating potential fixes, including the integration of automated secret scanning. In the interim, security experts advise developers to manually audit their repositories for exposed configuration files and to utilize robust secret detection tools, as some existing scanners failed to identify 215 of the leaked secrets found during the investigation.
Source: Ars Technica
