Apiiro finds 2,539 live secrets exposed in 1,994 public GitHub repos via Claude Code settings.local.json allowlists
Researchers at Apiiro reported that Claude Code's permission allowlist mechanism has leaked credentials into 1,994 public GitHub repositories. When a developer picks "Yes, and don't ask again" for a proposed shell command, the agent stores the literal command string — including any inline password or token — as an allow rule in .claude/settings.local.json inside the project folder. Scanning 104,185 public copies of the file between 1 and 3 November 2026, Shmulik Cohen and Matan Giladi found 1,379 distinct secrets on default branches across 1,122 active files, rising to 2,539 real secrets once git history, shared settings files and agent chat transcripts were included. Apiiro published the study on 5 November 2026 (pasqualepillitteri.it, dev.to) and notified the 63 affected organisations on 2 and 3 November; at least one confirmed its exposed key was live. The behaviour in Anthropic's coding tool remains unchanged up to Opus 5.5 and no vendor advisory or public Anthropic statement on the issue was found at the time of writing.
Detalhes técnicos
The exposed material includes 398 service API tokens, 379 database passwords, 149 AI model API keys, 122 Supabase service-role keys, 110 Google API keys, 103 Supabase account tokens and 43 SSH logins; among the worst cases were a database vendor's admin-level cloud key, a Square production token and the owner password of a medical-records database. Claude Code adds the file to git's global exclude list the first time it writes it in a repository, but that rule never reaches the project's own .gitignore, so the protection fails when a folder becomes a repository later or is cloned to another machine (pasqualepillitteri.it). Commits co-authored by Claude modified the secret-bearing file in 539 of the 1,105 traced repositories. Conventional secret scanners are weak against this pattern: gitleaks and TruffleHog missed 215 of the 1,122 exposed files, because they key on structured provider prefixes rather than plain passwords typed inside PGPASSWORD, sshpass or curl headers. Exposed configuration files were also observed on Hugging Face Spaces and GitLab. The researchers did not test any credential or contact any host, defining a real secret as one matching a known provider format or a password paired with a public host, after filtering placeholders and expired tokens. Users had reported the mechanism in GitHub issues since August 2025 (#5544, #11982, #13106, #91270) without a reply.
Remediação
Search repositories and developer machines for .claude/settings.local.json and .claude/settings.json; where a secret is found, rotate it first and clean up afterwards, since deleting the file leaves the value in git history, clones and the 211 public forks identified. Untrack the file with git rm --cached, add agent configuration folders to the repository .gitignore template, reference credentials through environment variables such as $DB_URL instead of inline passwords, and extend pre-commit scanners to catch inline command passwords as well as standard provider tokens.
Linha do tempo
-
Apiiro finds 2,539 live secrets exposed in 1,994 public GitHub repos via Claude Code settings.local.json allowlists
ler a análise desta fonte ocultar
Researchers at Apiiro reported that Claude Code's permission allowlist mechanism has leaked credentials into 1,994 public GitHub repositories. When a developer picks "Yes, and don't ask again" for a proposed shell command, the agent stores the literal command string — including any inline password or token — as an allow rule in
.claude/settings.local.jsoninside the project folder. Scanning 104,185 public copies of the file between 1 and 3 November 2026, Shmulik Cohen and Matan Giladi found 1,379 distinct secrets on default branches across 1,122 active files, rising to 2,539 real secrets once git history, shared settings files and agent chat transcripts were included. Apiiro published the study on 5 November 2026 (pasqualepillitteri.it, dev.to) and notified the 63 affected organisations on 2 and 3 November; at least one confirmed its exposed key was live. The behaviour in Anthropic's coding tool remains unchanged up to Opus 5.5 and no vendor advisory or public Anthropic statement on the issue was found at the time of writing.Technical Details
The exposed material includes 398 service API tokens, 379 database passwords, 149 AI model API keys, 122 Supabase service-role keys, 110 Google API keys, 103 Supabase account tokens and 43 SSH logins; among the worst cases were a database vendor's admin-level cloud key, a Square production token and the owner password of a medical-records database. Claude Code adds the file to git's global exclude list the first time it writes it in a repository, but that rule never reaches the project's own
.gitignore, so the protection fails when a folder becomes a repository later or is cloned to another machine (pasqualepillitteri.it). Commits co-authored by Claude modified the secret-bearing file in 539 of the 1,105 traced repositories. Conventional secret scanners are weak against this pattern: gitleaks and TruffleHog missed 215 of the 1,122 exposed files, because they key on structured provider prefixes rather than plain passwords typed insidePGPASSWORD,sshpassorcurlheaders. Exposed configuration files were also observed on Hugging Face Spaces and GitLab. The researchers did not test any credential or contact any host, defining a real secret as one matching a known provider format or a password paired with a public host, after filtering placeholders and expired tokens. Users had reported the mechanism in GitHub issues since August 2025 (#5544, #11982, #13106, #91270) without a reply.Remediation
Search repositories and developer machines for
.claude/settings.local.jsonand.claude/settings.json; where a secret is found, rotate it first and clean up afterwards, since deleting the file leaves the value in git history, clones and the 211 public forks identified. Untrack the file withgit rm --cached, add agent configuration folders to the repository.gitignoretemplate, reference credentials through environment variables such as$DB_URLinstead of inline passwords, and extend pre-commit scanners to catch inline command passwords as well as standard provider tokens.