Apiiro finds 2,539 secrets exposed in 1,994 public GitHub repos via Claude Code "Don't Ask Again" settings files
Application-security vendor Apiiro published research on 5 November 2026 showing that Claude Code's "Yes, and don't ask again" approval option can persist a full shell command — credentials included — as an allowlist rule in .claude/settings.local.json, which developers then commit to public repositories. Apiiro counted 2,539 distinct secrets across 1,994 public GitHub repositories, including production database passwords, cloud credentials, API tokens and SSH logins, affecting 63 organizations; one notified organization confirmed its exposed key was live. The research was authored by Apiiro's Shmulik Cohen and Matan Giladi (itwire.com), who say they reproduced the behaviour with the latest models, Opus 5.5 and Fable 5.1, and that of 16 coding agents whose documentation they compared, Claude Code is the only one confirmed to save the full approved command in a project file by default (thehackernews.com). This is a configuration and developer-hygiene exposure rather than a product vulnerability: no CVE has been assigned and Anthropic has published no advisory on the matter; Apiiro did not test the credentials, so its "real secret" classification indicates credible material, not verified validity. The operational risk is nonetheless real, as infostealers and supply-chain worms already scan developer workstations for credentials and for Claude Code authentication artifacts.
Detalhes técnicos
The leak starts when Claude Code proposes a command containing credentials pulled from configuration files or supplied during troubleshooting. Choosing persistent approval stores the literal command as an allow rule instead of stripping its sensitive arguments. Claude Code adds the file to the developer's global git excludes the first time it writes it in a repository, per its settings documentation, but that protection lives in one user's git configuration on one machine, does nothing for an already-committed file and is never written to the project's own .gitignore (thehackernews.com). In 539 of 1,105 traced repositories, a commit listing Claude as co-author changed the file, suggesting the agent frequently commits it itself (thehackernews.com).
Across 104,185 public copies of .claude/settings.local.json in 103,617 repositories, Apiiro found 1,122 files holding 1,379 distinct secrets — 636 provider-format keys and 743 passwords or tokens tied to public hosts. Database access dominated: 379 database passwords, 122 Supabase service-role keys and 103 Supabase account tokens, plus 43 SSH credentials (including root logins embedded in sshpass commands), 23 AWS keys and six private keys. Historical versions of deleted files contain 734 further secrets across 509 repositories, 211 forks of 74 repositories replicate the credentials, and 298 of 76,011 shared .claude/settings.json files also carry secrets (thehackernews.com). As of 2 November, every secret-bearing file was still on its repository's default branch, present for at least 217 days in half of them (thehackernews.com). Detection tooling was unreliable: Gitleaks flagged 564 secret-bearing files and TruffleHog 643, while neither flagged 215 — passwords following PGPASSWORD=, sshpass -p or mysql -p lack recognizable provider prefixes.
Remediação
Search the organization for .claude/settings.local.json and .claude/settings.json, including in git history where the files were deleted. Rotate every credential the files have ever held before cleanup, since deletion does not undo historical and fork exposure. Untrack the local file (git rm --cached) and add it to the repository's own .gitignore, then purge rules containing secrets from local copies even when never committed. Replace literal secrets with secret-manager-backed environment-variable references (e.g. $DB_URL) and approve command patterns such as Bash(npm run:*) instead of exact commands (thehackernews.com). Add pre-commit and CI scanning able to detect passwords embedded inside command lines, and check npm package contents, Docker images and archives that may ship the file.
Linha do tempo
-
Apiiro finds 2,539 secrets exposed in 1,994 public GitHub repos via Claude Code "Don't Ask Again" settings files
ler a análise desta fonte ocultar
Application-security vendor Apiiro published research on 5 November 2026 showing that Claude Code's "Yes, and don't ask again" approval option can persist a full shell command — credentials included — as an allowlist rule in
.claude/settings.local.json, which developers then commit to public repositories. Apiiro counted 2,539 distinct secrets across 1,994 public GitHub repositories, including production database passwords, cloud credentials, API tokens and SSH logins, affecting 63 organizations; one notified organization confirmed its exposed key was live. The research was authored by Apiiro's Shmulik Cohen and Matan Giladi (itwire.com), who say they reproduced the behaviour with the latest models, Opus 5.5 and Fable 5.1, and that of 16 coding agents whose documentation they compared, Claude Code is the only one confirmed to save the full approved command in a project file by default (thehackernews.com). This is a configuration and developer-hygiene exposure rather than a product vulnerability: no CVE has been assigned and Anthropic has published no advisory on the matter; Apiiro did not test the credentials, so its "real secret" classification indicates credible material, not verified validity. The operational risk is nonetheless real, as infostealers and supply-chain worms already scan developer workstations for credentials and for Claude Code authentication artifacts.Technical Details
The leak starts when Claude Code proposes a command containing credentials pulled from configuration files or supplied during troubleshooting. Choosing persistent approval stores the literal command as an allow rule instead of stripping its sensitive arguments. Claude Code adds the file to the developer's global git excludes the first time it writes it in a repository, per its settings documentation, but that protection lives in one user's git configuration on one machine, does nothing for an already-committed file and is never written to the project's own
.gitignore(thehackernews.com). In 539 of 1,105 traced repositories, a commit listing Claude as co-author changed the file, suggesting the agent frequently commits it itself (thehackernews.com).Across 104,185 public copies of
.claude/settings.local.jsonin 103,617 repositories, Apiiro found 1,122 files holding 1,379 distinct secrets — 636 provider-format keys and 743 passwords or tokens tied to public hosts. Database access dominated: 379 database passwords, 122 Supabase service-role keys and 103 Supabase account tokens, plus 43 SSH credentials (including root logins embedded insshpasscommands), 23 AWS keys and six private keys. Historical versions of deleted files contain 734 further secrets across 509 repositories, 211 forks of 74 repositories replicate the credentials, and 298 of 76,011 shared.claude/settings.jsonfiles also carry secrets (thehackernews.com). As of 2 November, every secret-bearing file was still on its repository's default branch, present for at least 217 days in half of them (thehackernews.com). Detection tooling was unreliable: Gitleaks flagged 564 secret-bearing files and TruffleHog 643, while neither flagged 215 — passwords followingPGPASSWORD=,sshpass -pormysql -plack recognizable provider prefixes.Remediation
Search the organization for
.claude/settings.local.jsonand.claude/settings.json, including in git history where the files were deleted. Rotate every credential the files have ever held before cleanup, since deletion does not undo historical and fork exposure. Untrack the local file (git rm --cached) and add it to the repository's own.gitignore, then purge rules containing secrets from local copies even when never committed. Replace literal secrets with secret-manager-backed environment-variable references (e.g.$DB_URL) and approve command patterns such asBash(npm run:*)instead of exact commands (thehackernews.com). Add pre-commit and CI scanning able to detect passwords embedded inside command lines, and check npm package contents, Docker images and archives that may ship the file.