Apiiro finds secrets in 1,122 public Claude Code settings files
Apiiro says the saved commands preserved passwords and keys in .claude/settings.local.json, and broader scans found 2,539 secrets across 1,994 public repositories.
By RuntimeWire Staff · Published
Primary source: Aligned News — AI Intelligence
Why it matters
Coding agents now write durable permission files inside project folders, so a routine approval can become a credential-storage decision. Operators using Claude Code need to rotate exposed secrets, scan agent folders and Git history, and replace literal credential-bearing commands with patterns and secret-manager variables.
Passwords and API keys that developers approved inside Anthropic's Claude Code are sitting in public GitHub repositories after the tool saved the underlying commands in a project settings file, according to research published on November 5th by security company Apiiro. The Hacker News reported that Apiiro researchers Shmulik Cohen and Matan Giladi found 1,122 public copies of the file holding at least one secret.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.