TL;DR
Did Claude Code leak my passwords?
Security firm Apiiro found 1,122 public copies of a Claude Code settings file on GitHub holding passwords or keys. If you ever approved a command with a key in it, it may be saved in that file. Rotate any exposed key first, then remove the file from Git and add it to .gitignore.
What did Apiiro find?
Claude Code is Anthropic's AI coding assistant, which runs commands on your computer after asking permission. When it asks, one choice is "Yes, and don't ask again." Apiiro's research, published on Friday, November 6, 2026, shows that choice can save the exact command, including any password or key typed into it, in a project file called .claude/settings.local.json.
Apiiro searched public GitHub and found 104,185 copies of that file. Of those, 1,122 (about 1.1%) held at least one real secret, 1,379 distinct secrets in all.
| What leaked | Count |
|---|---|
| Database passwords | 379 |
| SSH logins (remote server access) | 43 |
| GitHub, GitLab and npm tokens | 42 |
| AWS keys (Amazon cloud access) | 23 |
More than a third of the leaked secrets open a database directly, according to The Hacker News.
How do the files end up on GitHub?
Through ordinary commits. Claude Code's settings docs say it keeps the file out of Git (the version-control tool that uploads code to GitHub) when Claude Code creates it, but "if you create it by hand, add it to .gitignore yourself." A .gitignore is the list of files Git should skip.
Apiiro says many of the leaky commits were co-authored with Claude. That doesn't make it an Anthropic leak: users committed the files. Apiiro also didn't check whether most secrets still work, and only one company it notified confirmed its key was live. So this is an exposure finding, not a confirmed breach. Old files can still live on in a project's Git history and in forks, copies others made of it.
A chatbot builder had a breach the same week
Also on Friday, chatbot builder Botpress posted a security incident disclosure. An attacker read bot configurations in 16 customer workspaces on October 21, and 2 more had an integration changed. Botpress told affected customers to treat every credential stored in those bots, including AI provider API keys, messaging tokens and CRM logins, as exposed.
X reactions
Security posters on X picked up the finding over the weekend.
Apiiro found secrets in 1,122 public copies of Claude Code’s settings.local.json. Researchers did not check whether most remain valid; one notified company confirmed its key was live. Git history and forks can retain the files.
— Cybersecurity News Everyday (@TweetThreatNews) November 7, 2026
https://t.co/9nCdGopIP6
Our take
A button that saves you a click should not also save your database password in plain text. Claude Code's docs do warn about hand-made files, but most people who click "don't ask again" have never read a settings page, and a lot of them are newer coders building with AI for the first time.
The fix on your side is cheap, and the order matters. Rotate first, because deleting a file doesn't kill a key that's already been copied. Then clean up. Longer term, stop typing secrets into commands at all; put them in environment variables or a password manager, and approve the pattern of a command rather than one exact line with a password in it.
— Artificially Nerdy
How to check and fix your projects
- Open
.claude/settings.local.jsonin each project and look for passwords, tokens or keys inside saved commands. - Rotate anything you find at the provider (database host, GitHub, AWS and so on) before anything else.
- Untrack the file and add it to the project's
.gitignore, then commit. - Turn on secret scanning. GitHub's secret scanning flags known key formats in your repos.
- Botpress customers: follow its disclosure and rotate the credentials stored in your bots.
Our 10-minute key check walks through the same clean-up for chatbot builders and automation apps.
FAQ
Is Claude Code safe to use?
Yes, with care. The risk comes from approving commands that contain secrets and then committing the settings file. Keep secrets out of commands and the file stays harmless.
If I delete the file, am I safe?
No. The file can stay in Git history and in forks. Rotating the key is the only way to make a leaked one useless.
Did Anthropic respond?
We found no public response from Anthropic as of Monday morning.
Is my project private enough?
Apiiro searched public GitHub. Private repos weren't part of its count, but rotating any key that sits in a shared file is still good practice.
Sources
- Apiiro: Coding agents leaking secrets on GitHub — November 6, 2026. File counts, secrets, co-authored commits, advice.
- Claude Code docs: Settings — where the file lives and the .gitignore note.
- The Hacker News: Claude Code's "don't ask again" file — November 7, 2026. Secret type breakdown.
- Botpress: Security incident disclosure, November 2026 — November 6, 2026.
- GitHub Docs: About secret scanning.
- Cybersecurity News Everyday on X — November 7, 2026, 6:00am ET.
