Claude Code AI Tool Leaks Secrets into 1,122 Public GitHub Repos
Anthropic's Claude Code assistant includes a 'Don't Ask Again' feature that persists user-approved commands — including passwords and API keys — into project-level settings files. When developers commit these files to public GitHub repositories without understanding what data is being stored, those secrets become instantly accessible to anyone on the internet. This incident illustrates a dangerous gap between developer convenience features and secure-by-default design: tools that silently write sensitive data to disk can inadvertently automate secret exposure at scale. The core failure is two-fold — the tool's default behavior was not sufficiently protective, and many users lacked awareness that committing project settings files could expose credentials.
Tactical Insight
Immediate actions
- Rotate all API keys and passwords found in any Claude Code settings files that have ever been committed to a repository, public or private.
- Add Claude Code settings files (e.g., `.claude/settings.json` or equivalent) to `.gitignore` templates across all projects to prevent future commits.
- Use a secret-scanning tool (GitHub Secret Scanning, TruffleHog, Gitleaks) to audit all repositories — public and private — for currently exposed credentials.
Developer tooling & configuration hardening
- Configure pre-commit hooks that block commits containing credential-like patterns before they reach any remote repository.
- Establish an organisational policy requiring that all AI assistant configuration files storing command history be classified as sensitive and excluded from version control.
- Evaluate any AI coding tool's data-persistence behaviour during procurement or adoption, ensuring secrets are never written to project directories in plaintext.
Long-term improvements
- Adopt a secrets-management solution (e.g., HashiCorp Vault, AWS Secrets Manager) so credentials are never typed inline in commands that any tool could capture.
- Provide mandatory security awareness training covering safe use of AI development assistants, specifically the risks of persistent command histories and settings files.
- Implement continuous repository scanning in CI/CD pipelines to detect and alert on any secret that slips through pre-commit controls.