Security company Apiiro found 2,539 real secrets across 1,994 public GitHub repositories, including credentials in Claude Code settings files, git history, shared settings and agent transcripts.

Key Takeaways

  • Apiiro found 2,539 real secrets across 1,994 public GitHub repositories, including credentials in Claude Code files and related agent records.
  • The issue centers on ".claude/settings.local.json" local files created after using the "don't ask again" option in Claude Code
  • Apiiro said it identified real secrets in public repos, meaning cloud keys, API tokens or internal credentials may have been exposed
  • Teams should review ignore rules, extend secret scanners into hidden folders, and rotate any key that reached a public repository

Apiiro said the problem centers on ".claude/settings.local.json," a local file developers can accidentally commit after using a "don't ask again" option inside Claude Code. Out of 104,185 public copies of that file on GitHub, 1,122 held a real secret, and 63 organizations were affected, including one that confirmed its key had been live.

Also Read: Anthropic's Claude Code Has Been Sending Users' Email Addresses To Websites

The numbers matter because these were not theoretical test strings. Apiiro said it identified real secrets in public repos, which means cloud keys, API tokens or internal credentials may already have been exposed to anyone scraping GitHub.

That turns a convenience feature into a supply chain risk.

Claude Code Secrets Turn Convenience Into Exposure

Coding agents increasingly ask for standing permission so they can run commands, install packages or call tools without stopping for every approval. That makes the tools feel faster, but it also creates a new class of residue where sensitive settings end up written to disk and later pushed into version control.

Once a file enters a public repository, copies can spread quickly through forks, mirrors and search indexes.

Even if a developer deletes the file later, the secret may already have been copied.

Apiiro's finding lands in a wider shift from autocomplete toward agentic coding. The newer tools do not just suggest lines of code, they also inspect files, execute tasks and remember decisions.

That broader scope makes local configuration files far more sensitive than they were in older coding assistants.

From Helpful Defaults To Real Attack Surface

Security teams have warned for years about hardcoded keys in source code. The new twist is that AI agents can create those exposures through permission memory rather than a developer manually pasting credentials into an app.

That distinction matters for response plans.

Traditional secret scanning looks for tokens inside source files, while agent-generated risk can sit in hidden local paths, tool settings or machine-specific folders that developers never expected to publish. Security programs built around code review alone can miss that path.

The problem also fits a pattern in enterprise AI rollouts.

Companies add agents to speed engineering work, then discover the tool created new storage, logging or approval states outside normal policy controls. Those blind spots are one reason many organizations now treat AI developer tools as security products, not just productivity software.

What Developers Need To Check Now

Teams using Claude Code should review whether local settings files are excluded from commits and whether repository scanners cover hidden directories.

They should rotate any key that may have reached a public repository, because deletion does not guarantee the credential stayed private.

Apiiro’s report specifically highlights ".claude/settings.local.json" as the path where persistent permission records are stored after using the "don't ask again" option. That file is the vector tying Anthropic's agent behavior to exposed tokens in public GitHub repositories.

Developers should watch for vendor changes to file paths, ignore rules and permission storage because those interface details decide whether agent speed stays local or becomes a public leak.

Why Hidden Files Matter More

Claude Code secrets are dangerous because they hide in places many teams do not review closely.

A developer may think the sensitive action happened inside the assistant, but the real evidence lives in a config file on disk. When that file gets committed to GitHub, the exposure stops being a personal mistake and becomes a repository problem.

For platform teams, the fix is straightforward.

Add the local file path to ignore lists, extend secret scanners into hidden folders and block commits that contain known agent settings files. Rotate credentials fast when a repo goes public.

For vendors like Anthropic, pressure will grow on default storage choices and safer permission memory, the next battleground in coding agents may be where the agent writes its memory.

Read Next: GitHub Guide Puts Copilot Across 4 Coding Jobs, Humans Decide

Originally published on Fathom News.