AI security researchers at Apiiro have identified a significant data exposure issue involving Anthropic's Claude Code. The study found that thousands of sensitive credentials, including database passwords, API tokens, and root login details, are being inadvertently published on public GitHub instances. This widespread leak is attributed to a specific oversight in how the software handles its local configuration files.
The vulnerability arises from the mechanism used to manage user approval for automated shell commands. When a developer authorizes a command to run automatically by selecting the option to not ask again, the software records this preference in a local file named .claude/settings.local.json. While the rule may be defined as a pattern, the actual command string is often saved exactly as entered. If that command contains embedded sensitive information, such as a password or key, it is stored in plain text within this settings file.
On a standalone local machine, this practice presents a relatively low risk, provided the device remains secure. Anthropic's documentation for Claude Code states that this specific settings file is added to the developer's global .gitignore list. This configuration typically prevents the file from being tracked by version control systems and subsequently shared publicly.
However, the global .gitignore setting does not automatically apply to the specific repository level. This discrepancy means the file can be easily committed and pushed to a remote server if a project is cloned to a different machine or if a folder is later initialized as a new repository. Apiiro noted that in many instances, Claude Code itself commits changes to the settings file without requiring explicit user confirmation, further increasing the likelihood of accidental uploads.
The scale of the issue is substantial. Apiiro's analysis identified more than 100,000 cases where the local settings file for Claude Code had been uploaded to public GitHub repositories. Of these numerous instances, approximately 1,100 files originating from 63 distinct organizations contained active secrets, including private keys, public API tokens, and database passwords.
The discovery highlights a common pitfall in managing development environments with automated tools. Even when developers follow standard practices, the interaction between global configuration files and repository specific settings can lead to unintended data exposure. The researchers emphasize that the presence of these files in public domains makes the contained secrets accessible to anyone with internet access.
Removing the files from the main repository is not always sufficient to secure the data. If a GitHub user has forked the original project before the sensitive file was deleted, the secrets can persist within those forks. This creates a lingering risk that requires developers to audit not just their primary repositories but also any derived projects to ensure complete cleanup.
The findings from Apiiro serve as a reminder for developers using AI-assisted coding tools to monitor what is being committed to version control. While the software is designed to streamline workflows, the automated handling of configuration files can introduce unexpected security vectors. Teams are advised to review their .gitignore strategies and check for any recently uploaded local settings files in their public codebases.
This incident does not indicate a bug in the core logic of Claude Code but rather a nuance in how version control systems interact with global versus local configurations. The researchers suggest that both developers and tool creators may need to adjust their approaches to prevent similar leaks in the future. The report was published on November 9, 2026, and has already prompted discussions in the developer community about best practices for secure AI integration.
