TREE NEWS reports: Security firm Apiiro found that more than 100,000 Claude Code local settings files have been uploaded to public GitHub repositories, about 1,100 of which contain database passwords, API tokens, private keys or root login credentials. The files held 2,539 real credentials across 1,994 code repositories and affected 63 organizations. When users choose “Yes, and don’t ask again,” commands containing secrets may be written in plaintext to .claude/settings.local.json and later committed by mistake.
Anthropic’s Claude Code leaks secrets into GitHub repos, Apiiro finds
AI take
The leak is less a flaw in Claude Code than a predictable side effect of convenience-first prompts colliding with developers' habit of committing local config files. The exposure spans credentials for databases, APIs and root logins across dozens of organizations, meaning the blast radius extends well beyond individual developers to production systems and third-party services. The open question is whether tooling vendors will treat secret-writing defaults as a security boundary — and whether teams will start auditing .claude settings files the way they already scan for committed .env files.
Generated by AI for reference only.
Share on WeChat
Open WeChat → Scan → then tap "…" to send to a chat or Moments.
Tap "…" in the top-right corner to send to a chat or share to Moments.
Related News
16m ago
Adobe to integrate Google’s latest AI models into creative and productivity tools
23m ago
ECB’s Cipollone warns digital euro could be delayed if talks drag on
25m ago
Australia to Impose Mandatory Safety Rules on AI Developers
1h ago
China’s National Data Standards Committee Sets Up Embodied AI Data Standards Working Group
1h ago
IBM and Microsoft Launch Imagine Enterprise AI Agent Platform
1h ago
Bitdeer Q3 revenue hits record $320.7M as AI cloud backlog reaches ~$2.9B