Claude Code Caught Writing Passwords into Settings Files; 2,539 Real Credentials Found on GitHub

Nov. 10 — According to Ars Technica, security firm Apiiro found that more than 100,000 Claude Code local settings files had been uploaded to public GitHub repositories. About 1,100 of them contained database passwords, API tokens, private keys or root login credentials, involving 2,539 real credentials across 1,994 code repositories and affecting 63 organizations. When users select "Yes, and don't ask again," the original command text containing the key may be written into .claude/settings.local.json and then mistakenly committed to repositories. Boris Cherny of the Claude Code team said the team is looking into preventive measures and is considering building secret scanning into Claude Code.