Claude Code Vulnerability Exposes Sensitive API Keys in Public GitHub Repositories
Anthropic's AI coding assistant inadvertently saves plain-text credentials into project configuration files.
1AI Assistant Security Flaw
Claude Code, an AI coding assistant, saves approved shell commands into a local JSON configuration file. When users select the 'don't ask again' option, the tool records exact commands, including plain-text passwords and API keys. This behavior creates a significant security risk by storing sensitive credentials within project directories.
2Public Repository Data Exposure
Researchers identified 1,122 public GitHub repositories containing at least one secret within the .claude/settings.local.json file. These files often end up in public repositories because the tool fails to add them to the project's .gitignore file. Consequently, sensitive data becomes accessible to anyone with access to the public code.
3Scope of Compromised Credentials
The exposed data includes 1,379 unique secrets, ranging from database passwords to AWS keys and GitHub tokens. Over one-third of these secrets provide direct access to databases, including administrative-level keys. Researchers confirmed that at least one company had an active, live key exposed within these publicly accessible repository files.
4Persistence of Git History
Deleting the configuration file does not resolve the vulnerability, as sensitive data remains embedded in git history and repository forks. Even if the file is removed from the current branch, older commits preserve the secrets. Researchers found 734 additional secrets in older versions of files that are no longer present.
5Inadequate Git Exclusion Mechanism
Claude Code attempts to protect files by adding them to global git excludes, but this protection does not travel with the project. Because the tool does not modify the project-specific .gitignore, the file is frequently committed to repositories. This mechanism fails to secure files when projects are shared or cloned.
6Limitations of Secret Scanners
Standard secret scanning tools like gitleaks and TruffleHog frequently fail to detect these specific exposures. Because passwords are often embedded within complex command-line strings, scanners struggle to distinguish them from ordinary text. Over 200 files containing secrets were missed by both major scanning tools during the researchers' recent audit.
7Comparison With Other Agents
Among 16 coding agents analyzed, Claude Code is the only one confirmed to save full approved commands in a project file by default. This unique design choice significantly increases the likelihood of accidental credential exposure. Other agents typically handle permissions and command execution without persisting sensitive input in plain-text files.
8Recommended Remediation Strategy
Security experts advise users to immediately rotate all passwords, tokens, and keys that have ever been held in the settings file. Simply deleting the file is insufficient due to git history persistence. Organizations should audit their repositories for these specific JSON files to prevent potential unauthorized access to their infrastructure.