Application security company Apiiro announced that its AI tool Claude Code was involved in the publication of developers' confidential information on GitHub. The company found 2,539 valid passwords and keys in 1994 public repositories. Moreover, the real surprise is that leaks can go unnoticed even by the most common browsers.
Claude Code settings file trap
The problem arises in how Claude Code remembers command permissions. For example, when the developer selects the "Yes, and don't ask again" option, the tool saves the approved command as is in the settings file in the project folder. Therefore, if there is a password or access key in the command, it is also written to the file.
This method is practical to avoid having to confirm the same transaction over and over again. However, if the file is published together with the code, the information is also revealed.
The confidential information found includes database passwords, API tokens, root SSH credentials, and cloud keys with administrative privileges. Additionally, in 539 of the 1,105 repositories containing confidential information, Claude participated in the commit of the file containing this information. Commit means recording the changes in the code.
Those affected and leaked data
Apiiro detected 104,185 public copies of such files in 103,617 GitHub repositories. But 1994 of them contained real classified information. Most of those affected are individual developers. Still, 63 institutions are also on the list: startups, software companies, and large software providers.
For example, the report counts a database provider's administrator-level cloud key, an Azure PostgreSQL production database password, a working Square token, and a medical records database's owner password.
Claude Code is trying to take precautions. When creating the file, it adds it to the developer's public .gitignore list. This list specifies files that Git should not put into version control. But the protection does not work in all cases.
It does not come into play, especially in repositories created later in an existing folder, in copies of the project on other computers, and in files that the developer has previously added to the repository. In addition, the general rule is that it is not written to the project's own .gitignore file, so it is not passed on to other team members.
Why do browsers miss it?
Popular crawlers like Gitleaks and TruffleHog generally look for long strings of random characters with known service prefixes. On the other hand, a password given with PGPASSWORD=, transferred with sshpass -p, or typed after mysql -p appears to the browser as ordinary text. Even the tokens in the authorization headers of curl commands can be overlooked.
The problem is not limited to Claude Code. Apiiro also found confidential information in correspondence histories with AI agents, memory files, task delegation and distribution notes, and automatic command confirmation settings of VS Code Copilot. As a matter of fact, similar files were also available in Hugging Face and GitLab repositories. Finally, the researchers warn that the data may also reach published packages, Docker images and project archives.
Boris Cherny, leader of the Claude Code development team, confirmed that Anthropic is examining ways to prevent such leaks. He also said that the settings file was not designed to be released under version control, and that the cases found were due to developers creating the file manually and adding it to the repository. However, Cherny suggested using the safer Auto mode instead of manually managing the permission and ban lists. He also recommended that scanning for private information on GitHub be turned on regardless of which AI tool is used.
Apiiro, on the other hand, recommends deleting all rules that contain plaintext confidential information and immediately changing any compromised passwords or keys. Deleting the file is not enough, because the content may remain in Git history, versions, and local copies. In addition, information should be given through environment variables that are linked to values in confidential information managers, instead of being written to the command. claude, cursor, gemini and specstory folders and artificial intelligence agent memory files should also be considered sensitive like .env.
