Claude Code setting leaves secrets in 1,122 public repos

Passwords and API keys typed into commands that developers approved inside Claude Code are sitting in public GitHub repositories where anyone can read them, according to software security company Apiiro, which published its findings on 6 November 2026.

The problem centres on a convenience feature in Anthropic's AI coding assistant. When Claude Code wants to run a terminal command, it asks the user to approve it. One of the options is "Yes, and don't ask again", which tells the tool to stop prompting for that command in future. Apiiro found that choosing it can cause Claude Code to save the command word-for-word in a project settings file. If the command contained a secret, such as a password or an API key, the secret is written out in full alongside it.

Project settings files of this kind normally live inside the repository itself, which means they are easy to commit and push without a second thought. Apiiro said it identified 1,122 public copies on GitHub that contain exposed secrets. The firm did not, in the material reviewed, break down which kinds of credentials were most common or which organisations were affected.

The pattern is a familiar one in a new wrapper. Developers have long been warned against pasting credentials directly into shell commands, because those commands end up in shell history files and logs. What is different here is that the agent is doing the writing, and it is writing into a file that exists specifically to be shared with the rest of the team through version control. A setting chosen to reduce friction during a coding session becomes a durable artefact in the repository.

The practical risk depends on what the leaked secrets unlock. A live API key in a public repository can be found by automated scanners within minutes of being pushed. Anyone who finds one can use it until it is rotated or revoked. Because the exposure happens through an ordinary configuration file rather than through code, it can also slip past reviewers who are scanning diffs for logic changes rather than reading settings.

For teams using Claude Code, the immediate checks are straightforward. Look at the project settings file that Claude Code maintains, see whether approved commands have been stored verbatim, and check whether any of them contain credentials. If they do, and the repository is public or has ever been public, the credentials should be treated as compromised and rotated. Removing the file from the latest commit is not enough on its own, because the secret remains in the repository's history.

The broader lesson is about where agents keep their state. Coding agents write configuration, caches, transcripts and approval lists to disk as they work, and much of that lands inside the working directory by design. Anything inside the working directory is a candidate for being committed. Organisations deploying agent tooling may want to decide, in advance, which agent-generated files are allowed into version control and which belong in an ignore list.

Anthropic's response to the findings was not included in the material reviewed, and it is not clear whether the company plans to change how approved commands are stored. Apiiro's figure of 1,122 repositories reflects public code only; exposures in private repositories would not be visible to an external scan.