← Back to blog

Claude Code's Saved Commands Leak Secrets on GitHub

Anthropic's AI assistant may be storing sensitive credentials in public repos when users opt out of confirmation prompts. Over 1,100 instances were found by security researchers.

TL;DR

  • Anthropic's Claude Code saves full commands including secrets when users select 'don't ask again'
  • Security firm Apiiro discovered 1,122 public GitHub files containing leaked passwords and API keys
  • The issue stems from the AI assistant's project settings storage mechanism
  • Developers using the tool should audit their repositories for exposed credentials
  • Organizations should review AI-assisted development workflows for similar risks

Anthropic's AI-powered coding assistant, Claude Code, has been found leaking sensitive credentials into publicly accessible GitHub repositories. The issue occurs when developers approve commands containing passwords or API keys and choose the "Yes, and don't ask again" option, which stores the complete command in project settings files.

Security researchers at Apiiro discovered over 1,122 instances of these exposed credentials, raising serious concerns about how AI development tools handle sensitive information. The leaked data includes authentication tokens, database passwords, and other critical access keys that could enable unauthorized system access.

How the Leaks Occur

  • Claude Code's 'don't ask again' feature saves entire approved commands to project configuration files
  • These saved commands often contain embedded secrets like passwords, API keys, and tokens
  • The configuration files are stored in .claude directory within project repositories
  • When repositories are made public, these sensitive files become accessible to anyone
  • The feature was designed for convenience but creates persistent credential storage risks

Impact and Recommendations

  • Over 1,122 public GitHub repositories contain exposed credentials from Claude Code usage
  • Exposed secrets include cloud provider keys, database passwords, and third-party service tokens
  • Attackers can use these credentials to gain unauthorized access to associated systems
  • Development teams should immediately audit repositories for .claude configuration files
  • Organizations should implement credential scanning in their CI/CD pipelines and repository monitoring

Sources

Sources

Security email updates

One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.