Claude Code Left Passwords in 1,122 Files on GitHub

A software security company called Apiiro discovered 1,122 public GitHub repositories that contained leaked credentials due to Anthropic’s AI code assistant, Claude Code. By default, when using Claude Code, you have to approve each command it runs. However, if you select “do not ask again,” it will store the exact command (including any sensitive information) in a file named .claude/settings.local.json within your project directory. This file isn’t ignored by default in the repository’s .gitignore file, which means it can accidentally be committed and shared publicly. In total, there were 1,379 leaked secrets, ranging from database credentials to cloud keys and authentication tokens. One organization even confirmed that their key was still valid. Despite being reported on four separate occasions since at least August 2025, Anthropic has yet to address these issues.

This issue doesn’t lie with the AI — rather, it’s a case of implicit consent. Once you approve a command, you’re essentially giving Claude Code blanket permission to run any future command without asking, secrets included. If you use Claude Code to execute terminal commands, make sure to remove this file from your repo (and ignore it yourself). While it’s important to wipe out any exposed credentials, keep in mind that they may exist elsewhere in GitHub’s revision history or in forks.