Claude Code is accidentally exposing secrets all over GitHub

Summary

Security researchers found Claude Code configuration files on public GitHub repositories exposing sensitive credentials from dozens of organizations. The issue stems from automated command approvals that cache raw arguments, which can bypass repository ignore lists when projects are cloned or committed. Anthropic developers stated they are examining technical mitigations and considering built-in secret scanning.

Key Takeaways

1. Claude Code settings files uploaded to public GitHub repositories exposed credentials across dozens of organizations.
2. The vulnerability occurs when automated command approvals write sensitive arguments directly into configuration files that can be inadvertently committed to version control.
3. Claude Code developers acknowledged the issue and stated they are considering integrated secret scanning to prevent future repository leaks.

Statement Breakdown

• Claimed Facts: 75% of statements the article presents as facts
• Opinions: 15% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The reporting relies on empirical findings from cybersecurity firm Apiiro and on-the-record statements from Claude Code developer Boris Cherny. It includes specific figures on exposed repositories, compromised organizations, and scanner miss rates. The piece also contextualizes the problem using earlier public bug reports and documentation from Anthropic.

Bias assessment: Technical Security Reporting. The presentation is analytical and relies on factual reporting of software behaviors and research data. It provides space for the developer's perspective and suggestions alongside the security findings. The article also places the incident in a wider industry context without using alarmist language.

Note: Relies on findings from security firm Apiiro and developer responses on public forums.

Credibility flag: Independent Research

Claimed Facts (4)

• The sentence presents a quantitative measurement of public configuration files discovered by security researchers.
• The researchers report specific counts of exposed credentials and affected organizations.
• The author reports the administrative history of earlier bug submissions on the project.
• The researchers provide concrete data on detection failures observed in established credential scanners.

Opinions (2)

• The author expresses a subjective assessment of the severity of the security issue under specific local operating conditions.
• Boris Cherny gives a subjective evaluation and product recommendation regarding permission management modes.

Claims (1)

• Boris Cherny claims the files are only checked in when manually created, but Apiiro reports that Claude Code itself often commits changes to the file without user input.

Key Sources

• Apiiro — AI cybersecurity research firm that discovered the exposed credentials
• Boris Cherny — Claude Code development team member at Anthropic
• Kyle Orland — Senior Gaming and Tech Editor at Ars Technica