Claude Code: 5,343 live secrets in public approval files

01What happened

GitGuardian published a scan of public GitHub and Docker Hub on November 9, 2026, counting 31,088 distinct secrets in .claude/settings.local.json across 23,276 repositories and 11,336 authors, 5,343 of them still valid at detection. Apiiro reported the same exposure pattern days earlier with a smaller, conservatively filtered count and no validity check. No fix had shipped from Anthropic when GitGuardian published.

02How it works

Answering Yes, and don't ask again to a shell command prompt makes Claude Code save that approval as an allow rule holding the full command as typed, so an API key or a password inside the command is written to disk. Anthropic's own documentation says Claude Code adds the file to the user's global git excludes the first time it writes it, which means a repository that already tracks the file, or a file the developer created by hand, is not covered. Container images built with COPY . . ship the working tree, so git-ignored files travel into the image unless .dockerignore excludes them. GitGuardian scans every public commit as it is pushed, so its count includes versions later deleted or force-pushed away.

03Who is affected

Database credentials are the most valuable of what leaked: 1,955 distinct valid Postgres connection strings, plus valid SSH passwords, MongoDB URIs and Google, Telegram, Resend and DeepSeek keys. Personal email domains account for 15,993 distinct secrets and corporate or custom domains for 5,924 across 3,338 domains, with education, research and software services making up about three-quarters of matched organizations. Other agent files leak too, and their counts sit in the table below. On Docker Hub, 543 image repositories and 7,625 tags carried 613 distinct secrets, 99 of them valid.

04What to do

Rotate every secret an approval file has ever held, because deleting the file does not revoke the credential, then add it to .gitignore and .dockerignore and remove credential-bearing rules through /permissions. Reference secrets as variables and approve narrow command prefixes rather than broad ones such as Bash(curl:*). Treat .claude/, .cursor/, .gemini/, .codex/, .mcp.json and CLAUDE.md as secret-bearing like .env, and scan them at pre-commit, in CI, in git history and in container registries.

Questions people ask

How do I check whether my repository leaked a Claude Code secret?

Search your repository history, not only the files at the current commit, because GitGuardian's companion lab test found just 2 of 9 planted credentials sitting at HEAD. Scan .claude/settings.local.json, .claude/settings.json, .claude/.credentials.json, CLAUDE.md and .codex/auth.json, then extend the same scanning to any container image built from the working tree.

Has Anthropic fixed Claude Code's secret-saving behaviour?

No fix had shipped when GitGuardian published on November 9, 2026. GitGuardian reports that Claude Code lead Boris Cherny said on Hacker News that the team is investigating, that Claude Code has not historically scrubbed secrets, and that an auto mode and built-in secret scanning are being prototyped. Until then, approving a command that contains a credential writes it to disk.

Is it enough to delete the Claude Code file from my repository?

Deleting the file revokes nothing, so rotate every credential it ever held first. GitGuardian scans each public commit as it is pushed, which means its count includes secrets that authors later deleted or force-pushed away, and anyone watching the same stream could have captured them. Add the file to .gitignore and .dockerignore afterwards so it does not return.

Why did GitGuardian count far more secrets than Apiiro did?

The two measured differently, GitGuardian explains. GitGuardian scans every public commit as it is pushed, catching versions later removed, and ran read-only validity checks on its detections. Apiiro used a conservative filter and did not test whether the secrets still worked. GitGuardian also calls its own validity figures floors, because detectors without a checker were not counted as valid.

Sources 2 links, all fetched

1. 1blog.gitguardian.comGitGuardian Research
2. 2code.claude.comClaude Code Settings