Passwords, API keys and other sensitive credentials entered into commands approved through Anthropic’s Claude Code assistant have been found in public GitHub repositories, according to research published by software security company Apiiro on November 5, 2026. The findings highlight how information used during routine development tasks can remain stored in project settings and become publicly accessible if those settings are accidentally shared. Claude Code allows developers to approve commands and choose an option that prevents the assistant from asking for permission again when running similar commands. When this option is selected, the assistant can save the approved command in a local project settings file. If the command contains a database password, access token or API key, that information may also be saved in plain text. Apiiro researchers found that this behaviour could expose credentials when the settings file is committed to a public repository. Their review identified 104,185 publicly available copies of the file across 103,617 GitHub repositories. Of these, 1,122 copies, approximately 1.1 percent, contained at least one potential secret, with 1,379 distinct credentials identified. The researchers did not test all the credentials to determine whether they remained valid or had been used to access systems. However, one organisation notified during the investigation reportedly confirmed that its exposed key had been active. The exposure can continue even after developers remove the settings file from a project because previous versions may remain in repository history, while copies can also survive in publicly available forks. Apiiro therefore recommends changing potentially exposed passwords, tokens and keys before attempting to remove the files or clean up repository history.
Claude Code’s permission system normally asks users before executing many shell commands. When developers select the option to remember an approval, the assistant stores a permission rule in the project’s local settings. Depending on what the user approved, this rule may contain a broad command pattern or the complete command exactly as entered. In the latter case, credentials included in the command can remain in the saved record. Anthropic’s documentation explains that Claude Code attempts to prevent this local settings file from being committed by adding it to the user’s global Git exclusion settings the first time the assistant creates it. However, this protection applies to the individual user’s computer and does not automatically become part of the project’s shared settings. It also does not remove a file that has already been committed to a repository. Apiiro found that, in 539 of the 1,105 repositories where it traced the relevant changes, a commit listing Claude as a co-author also modified the settings file. This finding indicates that the file was changed in commits associated with Claude, but does not establish that the assistant independently committed or published every exposed credential. The researchers also compared documentation for 16 AI coding assistants and said Claude Code was the only one in their review confirmed to save the complete approved command in a project file by default. Their wider investigation identified another 734 credentials in older versions of the local settings file across 509 repositories, while 211 forks of 74 repositories contained the same exposed information as their original projects. They also found credentials in 298 copies of a separate shared settings file that development teams intentionally commit to repositories. Including older file versions, shared settings and saved AI assistant conversations, Apiiro reported a broader total of 2,539 secrets across 1,994 repositories. The researchers identified 63 organisations associated with the exposed files, most of them software companies, and described examples involving an administrative cloud key and a password for a medical records database.
The investigation also raised questions about whether commonly used security scanners can reliably identify credentials saved inside AI-generated command permissions. Apiiro tested two widely used scanning tools against the files containing potential secrets. One identified 564 of the 1,122 files, while the other detected 643. Both tools failed to flag 215 files. According to the researchers, many missed credentials were ordinary passwords embedded within command text rather than recognisable API key formats. This can make them harder for automated scanners to distinguish from regular command instructions. The findings are particularly relevant as developers increasingly use AI assistants to interact with databases, cloud platforms and software services. A credential entered during one of these tasks can remain in a local settings file even after the original command is no longer needed. Files that are not published on GitHub may also be exposed through other channels, including software packages, container images, compressed project archives and synchronised folders. The researchers noted that malware has previously searched developer machines for sensitive information. In September 2025, the Shai-Hulud worm used a credential-scanning tool on infected computers, demonstrating how exposed development credentials can become useful to malicious actors. Apiiro recommends that development teams inspect both current repositories and their previous versions for local and shared AI assistant settings files. They should also review other folders and saved conversations created by coding assistants, rather than limiting security checks to application source code. The company advises organisations to include these files in their security scanning processes and ensure that scanners can identify passwords embedded in commands, not just recognised key formats. Its findings should be understood as a report of potential credential exposure, rather than proof that all identified accounts or systems were accessed.
Developers who have used Claude Code should review their local project settings and remove any saved permission rules containing passwords, tokens or API keys. If a credential has been committed to a public repository, security teams should revoke or replace it before cleaning up the exposed files. Removing the current copy alone is not sufficient because previous versions may remain accessible through repository history, forks and existing downloads. Teams should also prevent personal settings files from being tracked by Git and add appropriate exclusions to their projects’ own shared protection rules. Apiiro further recommends avoiding the practice of placing passwords directly inside commands. Instead, developers should retrieve sensitive information from a dedicated secrets manager or use environment variables that reference credentials without including their actual values in saved command text. The researchers also advise approving broader, carefully defined command patterns where appropriate rather than repeatedly approving individual commands containing sensitive information. Security teams should extend these checks to folders used by other AI coding assistants, including tools that store project settings, activity records and saved conversations. An earlier report submitted to Anthropic’s Claude Code GitHub issue tracker on August 11, 2025, had already described how approved commands containing API keys and tokens could be stored in plain text within the local settings file. The report was automatically closed on January 3, 2026, after a period of inactivity. Apiiro said that related reports it reviewed had also been closed automatically, without a response from Anthropic recorded in those discussions. The earlier reports show that concerns about this behaviour had been raised before the latest research, although their closure does not establish why no technical response was provided. The findings underline the importance of reviewing what AI coding assistants retain after a command is approved. While these tools can simplify development tasks, saved permissions and project settings also need to be treated as potential locations for sensitive information. Organisations should include them in credential management, repository reviews and routine security checks to reduce the possibility of accidental exposure.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
