Application security company Apiiro disclosed the findings on 5 November after examining publicly accessible repositories. Its investigation identified a particular risk in Anthropic’s Claude Code assistant: approving a shell command with the option “Yes, and don’t ask again” can preserve the entire command, including passwords or access tokens, in a local settings file.
The file,. claude/settings. local. json, stores permission rules intended to spare developers repeated approval prompts. When a command contains credentials directly, the saved rule may retain those credentials in readable form. If the file is subsequently committed to a public repository, anyone able to view the repository may encounter the information.
Apiiro searched GitHub between 1 and 3 November and found 104,185 copies of the local settings file across 103,617 repositories. It classified 1,122 files, approximately 1.1 per cent, as containing secrets. Those files held 1,379 distinct credentials, before the investigation expanded to historical commits and other coding-agent records.
The exposed material included 379 database passwords, 122 Supabase service-role keys and 103 Supabase account tokens. Researchers also identified 43 SSH login credentials, 42 tokens associated with GitHub, GitLab and npm, 23 Amazon Web Services keys and six private keys. Such credentials can carry different levels of access depending on their permissions and whether they remain valid.
Apiiro said 63 organisations appeared among the owners of affected repositories, predominantly software businesses. Examples described by the researchers included an administrative cloud credential belonging to a database provider, a production PostgreSQL password associated with Microsoft Azure and a database owner password connected to medical records.
The findings establish that sensitive values were publicly accessible, not that every credential remained operational or had been exploited. Researchers did not attempt to authenticate with the exposed credentials. One organisation contacted during the investigation confirmed that a disclosed key was still active, according to Apiiro.
The company also identified 734 additional secrets in earlier versions of files across 509 repositories. This matters because removing a password from the latest version of a file does not automatically remove it from Git history. Copies retained by other users can further complicate efforts to contain an exposure.
Researchers found 211 forks of 74 repositories carrying the same secrets. They also examined shared Claude Code settings and saved agent conversations, including transcripts produced by other coding tools. Together, the different categories brought the investigation’s total to 2,539 distinct secrets across 1,994 repositories.
Anthropic’s documentation confirms that Claude Code writes standing command approvals into the project-local settings file. It says the software ordinarily adds that file to a developer’s global Git exclusion rules, helping prevent accidental commits from that computer. However, those exclusions do not automatically become part of the project’s shared. gitignore file.
That distinction can leave repositories vulnerable when files are tracked through another environment, deliberately added or already included in version control. A shared exclusion rule travels with the project, whereas a global exclusion normally applies only to the individual developer’s Git configuration.
Apiiro examined commit records for 1,105 affected repositories and identified 539 in which changes to the settings file appeared in commits crediting Claude as a co-author. The finding does not establish that the assistant independently published every affected file, but indicates that AI-assisted commit workflows formed part of the exposure pattern.
The investigation also assessed established secret-scanning tools. Gitleaks flagged 564 of the 1,122 secret-bearing local settings files, while TruffleHog flagged 643. Neither tool flagged 215 files in the researchers’ tests, which did not use the tools’ credential-verification capabilities.
Security teams addressing exposed credentials generally need to revoke or rotate affected passwords and tokens rather than relying solely on deleting repository files. Reviewing Git history, checking forks and applying repository-level exclusion rules can help identify and limit additional copies.
The researchers also found that exposure was not confined to unusually configured repositories. Some files had remained publicly accessible for months, increasing the opportunity for discovery through routine searches, automated indexing and copies made outside the original project.
Apiiro additionally examined 76,011 publicly accessible shared Claude Code settings files and identified 298 containing secrets. Unlike personal settings, shared configuration files are intended for inclusion in repositories, making careful review of their permission rules especially important.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
