Claude Code settings leak thousands of corporate passwords on GitHub

Security firm Apiiro revealed that Anthropic's coding assistant, Claude Code, has exposed thousands of software keys and passwords in public GitHub repositories. The problem stems from an everyday convenience setting inside the tool rather than a compromise of the underlying model.

When a developer uses Claude Code, the tool routinely asks for confirmation before executing command-line instructions. If the user selects the option to approve the command without being asked again, Claude Code records that exact command as a permanent rule in a project configuration file called .claude/settings.local.json. When those commands contain inline credentials, such as database passwords, server keys or cloud tokens, the software writes those credentials into the file in plain text.

Claude Code attempts to keep this file out of source control by adding it to a global ignore file on the developer's individual machine. However, that local guard does not attach to the project itself. If another contributor commits the file, or if the repository is moved or cloned across different environments, the settings file often ends up pushed to public repositories.

Apiiro scanned more than 104,000 public instances of the file and found that 1,122 contained exposed credentials, representing 1,379 distinct secrets across 63 organisations. When factoring in historical commits and project records, the total rose to 2,539 exposed secrets across nearly 2,000 repositories. The leaked credentials included cloud administration access, live database logins and payment platform tokens. Because the passwords sat inside ordinary terminal commands rather than standard credential formats, common security scanning software missed roughly a fifth of the exposed files.

What this means for Australian businesses

Many Australian businesses employ internal software teams or external contractors who use AI coding assistants to speed up work. This discovery demonstrates that everyday workflow conveniences in AI software can bypass basic security safeguards.

If your business or development contractors use Claude Code, you should take several immediate steps:

• Audit all internal and public repositories for any files named .claude/settings.local.json and ensure that path is explicitly added to the repository's .gitignore file.
• Assume any credentials previously typed into Claude Code prompts have been saved in plain text, and rotate those passwords, API tokens and database keys at the source.
• Instruct developers to load authentication keys through environment variables or dedicated secret management systems instead of pasting credentials directly into terminal commands or AI chat prompts.
• Review contractor contracts to clarify that third-party code review and security scans must specifically look for AI-generated configuration files.