# Claude Code is accidentally exposing secrets all over GitHub

Source: [AI - Ars Technica](https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/) · 2026-11-09 · Computing
Page: https://themorning.science/story/claude-code-is-accidentally-exposing-secrets-all-over-github-4065836ff3f518ca
Kind: security · Impact: high

## In brief

- Ars Technica reports that Claude Code is leaking sensitive information to public GitHub repositories due to a partial oversight in how its settings files are handled.
- Researchers at Apiiro say they found thousands of secrets, including database passwords and API keys, exposed on public GitHub.
- The source excerpt does not give a disclosure date for the findings, only the article date.

## Why it matters

Developers who use Claude Code and commit its settings files to public repositories may be exposing credentials, which can lead to unauthorized access to databases and services.

## What to do

- Check whether Claude Code settings files in your public repositories contain credentials.
- Rotate any database passwords or API keys that may have been committed in settings files.

## Timeline

- 2026-11-09: Ars Technica reports the Apiiro finding of exposed secrets from Claude Code settings files on public GitHub

## Coverage

- [Claude Code is accidentally exposing secrets all over GitHub](https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/) — AI - Ars Technica, 2026-11-09

Tags: claude code, github, secrets leakage, api keys, ai security

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Science – https://themorning.science