Security · High impact
Claude Code is accidentally exposing secrets all over GitHub
Ars Technica · By Kyle Orland ·
The Brief
- Ars Technica reports that Claude Code is leaking sensitive information to public GitHub repositories due to a partial oversight in how its settings files are handled.
- Researchers at Apiiro say they found thousands of secrets, including database passwords and API keys, exposed on public GitHub.
- The source excerpt does not give a disclosure date for the findings, only the article date.
Why it matters
Developers who use Claude Code and commit its settings files to public repositories may be exposing credentials, which can lead to unauthorized access to databases and services.
Who’s affected
- developers using Claude Code
- security teams responsible for public GitHub repositories
What to do
- Check whether Claude Code settings files in your public repositories contain credentials.
- Rotate any database passwords or API keys that may have been committed in settings files.
- #claude code
- #github
- #secrets leakage
- #api keys
- #ai security
Claude Code is leaking sensitive information on public GitHub instances thanks to a partial oversight in the way its settings files are handled. That's the finding of AI security researchers at Apiiro, who discovered thousands of secrets , including database passwords, API…
Timeline
Ars Technica reports the Apiiro finding of exposed secrets from Claude Code settings files on public GitHub
AI - Ars Technica
Claude Code is accidentally exposing secrets all over GitHub