Claude Code's approval file leaks developer secrets on GitHub

Overview

Updated 1 hour ago

When a Claude Code user approves a shell command with "Yes, and don't ask again," Anthropic's coding agent writes that command into a project file. If the command carried a database password or an API token, the credential goes in with it, in plain text.

Apiiro, a software security firm, searched public GitHub and found 104,185 copies of that file across 103,617 repositories. In 1,122 of them, at least one credential was sitting there for anyone to read.

Why it matters

Anyone who typed a password into an approved command may have published it already, and deleting the file will not remove it from git history.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

104,185

Copies of the settings file on public GitHub

Found across 103,617 repositories in Apiiro's scan.

1,122

Files holding at least one secret

About 1.1% of the copies found, carrying 1,379 distinct secrets between them.

379

Database passwords exposed

Most of these open a database directly; 43 files held SSH logins for public servers.

215

Files no scanner caught

gitleaks flagged 564 and TruffleHog 643 of the 1,122; neither flagged these.

217

Minimum age in half the repositories

In half the affected repositories the file had been on the default branch this long.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

Boris Cherny

Claude Code team, Anthropic

Publicly responding to the findings

Organizations Involved

Anthropic

AI company

Says it is looking into preventing secrets from being saved

The company behind Claude and Claude Code, the coding agent whose permission file is at the center of the leak.

Apiiro

Software security company

Published the scan of public GitHub

A software supply-chain security firm that scanned public GitHub for copies of Claude Code's local settings file.

GitHub

Software platform, subsidiary of Microsoft

Hosts the repositories where the files were found

The public code host where 103,617 repositories carried a copy of the file.

Timeline

August 2025 November 2026

6 events Latest: Yesterday

Tap a bar to jump to that date

November 2026
Reports tally 1,379 secrets across the files
Latest Investigation

Coverage counts 379 database passwords, 42 code-host tokens and 23 AWS keys.
Yesterday
Anthropic engineer responds on Hacker News
Statement

Boris Cherny says the file should stay local and points users to auto mode.
Yesterday
Independent test shows Claude can commit the file
Testing

With a fresh git config, an auto-mode commit includes the settings file and its password.
Yesterday
Apiiro publishes the scan
Research

The firm reports 1,122 public files holding at least one credential.
2 days ago
January 2026
Automated bot closes the report as not planned
Response

The report closes after 60 days without activity. Anthropic does not reply.
January 3rd, 2026
August 2025
Developer files bug report on saved secrets
Bug report

A user reports that approved commands with API keys and tokens are stored word for word.
August 11th, 2025

Scenarios

Anthropic redacts credentials before saving approval rules

Likely Resolves by Q1 2027

Discussed by: Anthropic's Boris Cherny, who said the team is looking into preventing the problem

The cleanest fix is at the write step: Claude Code detects a credential inside a command and either refuses the "don't ask again" option or stores a placeholder instead of the literal string. Anthropic's engineer has said scrubbing is under review, and the company already has reason to act because it is the only one of 16 coding agents Apiiro compared that saves the full approved command to a project file by default.

Anthropic documents the risk and leaves the behavior in place

Possible Resolves by Q1 2027

Discussed by: Developers on Hacker News, several of whom argued the file's local-only design makes the leak a user error

Anthropic's public position so far is that the file is meant to stay local, that Claude adds it to a user's global git excludes, and that users should switch to auto mode and turn on secret scanning. That points to a response made of documentation and warnings rather than code. The counter-pressure is that the global excludes file lives on one machine, so a copied project folder or a fresh git configuration can still send the file to GitHub.

A live key from a settings file is tied to a public breach

Uncertain Resolves by Q2 2027

Discussed by: Apiiro, which confirmed one notified company's key was still live but did not test the rest

The scan did not check whether the 1,379 secrets still work. If one does, and an attacker uses it, the resulting breach disclosure would convert a configuration problem into an incident with named victims and regulatory filings. The prior for this pattern is Uber's 2016 breach, where credentials left in a private repository opened an AWS account holding data on 57 million people.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

October 2016

Uber's GitHub credential breach (2016)

Attackers found Amazon Web Services credentials in a private GitHub repository used by Uber engineers. Those keys opened a cloud account holding names, email addresses and driver's licence numbers for 57 million riders and drivers. Uber paid the intruders $100,000 to delete the data and did not disclose the breach for a year.

Then

Uber's chief security officer was fired, and the company later paid a $148 million settlement across all 50 states.

Now

The case became the standard example of how a credential left in a code repository turns into a breach measured in millions of people.

Why this matters now

The Claude Code files differ in one way that matters: the secret is written by the tool as a side effect of a normal approval click, not by an engineer pasting keys into a config file.

September 2025

Shai-Hulud npm worm (2025)

A self-propagating worm spread through npm packages, harvesting credentials from infected developer machines. It ran the TruffleHog secret scanner over the files it found, and the scanner flagged more than half of them as secret.

Then

Hundreds of packages were affected and maintainers scrambled to remove malicious releases.

Now

It showed that developer laptops hold enough credentials to make scanning them worthwhile for attackers.

Why this matters now

Apiiro's finding is the same signal in a different place: plain-text credentials accumulating on developer machines, in a file many scanners do not recognise.