# Researchers find credentials in Claude Code settings across public GitHub repositories

- URL: https://talkfuse.com/story/claude-code-is-accidentally-exposing-secrets-all-over-github/
- Published: 2026-11-09T17:24:26+00:00
- Updated: 2026-11-09T18:27:23+00:00
- Original publisher: Ars Technica
- Original article: https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/
- Topics: Software

## Key points

- Apiiro found over 100,000 Claude Code settings files on public GitHub.
- About 1,100 files contained secrets linked to 63 organisations.
- Some secrets may persist in forks and evade popular scanners.

## Summary

Researchers at Apiiro found sensitive information in Claude Code settings files shared on public GitHub repositories. The issue matters because approving shell commands can save them, sometimes with embedded credentials, and those credentials may remain accessible in repository forks even after removal.

Apiiro found more than 100,000 uploaded settings files; about 1,100, linked to 63 organisations, contained secrets such as API tokens, database passwords or private keys. The files are meant to be excluded from version control by a global ignore setting, but that protection may not apply in all repository situations, and Claude Code can sometimes commit changes to the files. Anthropic’s Boris Cherny said the team is investigating improvements and recommended secret scanners, though 215 of the identified secrets were missed by two popular scanners.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.