# Claude Code Leaks Sensitive Credentials via GitHub Repositories Improper handling of automated shell command settings exposes API tokens and database passwords. - **Source:** [Ars Technica - All content](https://brifing.si/source/b728770c-8dda-457a-8986-84879c9fc42c) - **Published:** 2026-11-09 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/2fe535e2-0d00-4f3e-9bb8-d40fd319f2ca ## Widespread Credential Exposure Security researchers at Apiiro identified thousands of sensitive secrets leaked within public GitHub repositories. These exposed credentials include database passwords, API tokens, and root login information. The breach originates from Claude Code settings files that were inadvertently uploaded by developers, creating significant risks for organizations relying on the AI-powered coding tool. ## Flawed Command Approval Mechanism The vulnerability stems from how Claude Code manages user permissions for automated shell commands. When users select the 'Yes, and don't ask again' option, the tool logs this choice into a local settings file. This file, located at .claude/settings.local.json, often captures the full command string, including any sensitive parameters embedded within it. ## Persistence of Sensitive Data While local storage of such files is standard, the inclusion of raw command strings creates a security hazard. If these files are pushed to version control systems like GitHub, the secrets become publicly accessible. The issue highlights the dangers of automated tools recording user inputs without sanitizing potential credentials before saving them. ## Gitignore Configuration Limitations Anthropic documentation suggests that the .claude/settings.local.json file is automatically added to a developer's global .gitignore list. This mechanism is intended to prevent the file from being committed to public repositories. However, reliance on this configuration has proven insufficient, as many users may have overridden or failed to implement these global settings. ## Risk to Development Environments The exposure of root logins and database passwords provides attackers with direct entry points into sensitive infrastructure. Once these credentials are indexed on GitHub, malicious actors can automate the harvesting of these secrets. This incident underscores the necessity of rigorous security audits for AI coding assistants that interact with shell environments. ## Developer Responsibility and Oversight Developers using Claude Code must verify their repository configurations to ensure sensitive files are not being tracked. Even when tools promise automated protection, manual verification of git status remains a critical security practice. Developers should immediately audit their existing repositories for the presence of .claude/settings.local.json files to prevent further unauthorized access. ## Broader AI Security Implications This incident reflects a growing trend where AI productivity tools inadvertently compromise security postures. As these tools gain deeper access to local file systems and shell commands, the potential for accidental data leakage increases. Security teams must now treat AI coding assistants as potential attack vectors that require strict monitoring and policy enforcement. ## Mitigation and Future Outlook To mitigate this risk, users should rotate any exposed API tokens and passwords found in their commit history. Anthropic may need to update the tool to automatically redact sensitive information from log files. Moving forward, developers should prioritize secure configuration management to ensure that AI-driven automation does not undermine their overall cybersecurity. ## Sources covering this story - https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._