A newly identified 2,539 distinct secrets across 1,994 public GitHub repositories, tracing exposure to coding-agent configuration files, Git history, and saved transcripts.
Their November 5 research describes how Claude Code’s “Yes, and don’t ask again” approval can persist credential-bearing shell commands inside .claude/settings.local.json.
Exposed material included production database passwords, cloud credentials, API tokens, and SSH logins, affecting 63 organizations. One organization confirmed its exposed key had been live.
Claude Code’s “Don’t Ask Again” Feature Exposed
The leakage begins when Claude Code proposes a command containing credentials extracted from configuration files or supplied during troubleshooting.
Approving persistent execution stores the literal command as an allowlist rule rather than stripping its sensitive arguments.
Although Claude Code adds the settings file to a developer’s global Git ignore list when created inside a repository, that protection does not travel with the project. Separately, infostealer malware already targets Claude Code authentication artifacts.
Apiiro examined 104,185 public copies of .claude/settings.local.json across 103,617 repositories, finding 1,122 files containing 1,379 distinct secrets. These included 636 provider-format keys and 743 passwords or tokens associated with public hosts.
Database access dominated: 379 database passwords and 122 Supabase service-role keys appeared alongside 103 Supabase account tokens.
Researchers also identified 43 SSH credentials, including root logins embedded in sshpass commands, plus 23 AWS keys and six private keys in those exposed files.
The exposure extended beyond current configuration files. Historical versions contained 734 secrets absent from current copies, while shared .claude/settings.json files and agent transcripts expanded the overall count. Forks reproduced credentials from 74 repositories into 211 additional copies.
These persistent artifacts create opportunities for credential-harvesting supply-chain attacks, as shown by malicious Nx packages that scanned developer environments and tried to exploit locally installed AI tools. Deleting the latest file therefore leaves historical exposure intact.
Detection gaps were substantial: Gitleaks flagged 564 secret-bearing files, TruffleHog identified 643, and neither flagged 215. Passwords following PGPASSWORD=, sshpass -p, or mysql -p frequently lacked recognizable provider prefixes.
Apiiro’s findings therefore distinguish structured API-key detection from contextual command-line credential analysis. The risk also reaches local endpoints: TruffleHog-based secret scanning has appeared in Shai-Hulud malware operations, demonstrating how legitimate discovery utilities can support credential theft from developer workspaces and connected cloud environments alike.
Developers should rotate exposed credentials before cleanup, untrack .claude/settings.local.json, and add repository-local ignore rules.
Teams should inspect historical commits, shared settings, transcripts, and local allowlists, then replace literal secrets with secret-manager-backed environment-variable references.
Pre-commit and CI scanning should detect passwords inside commands. Apiiro did not test credentials or contact hosts; its “real secret” classification indicates credible credential material, not verified validity.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
