Two security firms have independently catalogued thousands of credentials — database passwords, API tokens, and root logins — exposed in Claude Code settings files committed to public GitHub repositories2,3.
GitGuardian found 31,088 distinct secrets in Claude Code settings files on public GitHub, 5,343 of which passed an automated, read-only validity check when detected. The firm's analysis, published on November 9, 2026, covers public commits from January 2025 through November 7, 2026. GitGuardian also found 613 secrets in public Docker Hub images, 99 of which passed its checks. The figures include credentials in versions later deleted or removed from repositories.
How the leak works
The exposure traces to how Claude Code handles user approval for automated shell commands. When a user selects the "Yes, and don't ask again" option to approve running a command, that choice is stored as an approval rule in the local .claude/settings.local.json file. If the approved command contains a password or token, the credential can appear in that rule.
Anthropic's documentation states that this settings file is added to the developer's global .gitignore list, which ordinarily prevents it from being shared publicly. But the exclusion is tied to the user's Git setup, not the project, and may not protect a file already tracked, copied to another environment, or committed by someone without the same exclusion.
Scope of the findings
Application security firm Apiiro published its own research on November 5. Apiiro found 1,379 secrets in 1,122 of 104,185 public copies of the settings file on GitHub. Its broader total was 2,539 secrets across 1,994 repositories, a figure that includes Git history, shared settings, transcripts, memory and handoff files, and VS Code Copilot auto-approve settings. Apiiro did not test whether its identified credentials still worked.
The two tallies are not directly comparable: GitGuardian monitored public commits over a longer period and ran validity checks, while Apiiro scanned a wider set of file types without testing credential status.
ANALYSIS The gap between the two counts — Apiiro's 1,379 settings-file secrets versus GitGuardian's 31,088 — likely reflects the difference in observation windows and detection methods rather than a contradiction, but it also underscores how difficult it is to pin down the true scale of the exposure.
Prior Vector Wire coverage documented how criminal hackers are already running autonomous attack campaigns powered by agentic AI[2], and the coding-agent market is expanding with multi-agent architectures[1].
ANALYSIS Credentials leaked through agent-generated files represent a supply-chain surface that grows with each new adoption.
GitGuardian's validity-check result — 5,343 secrets that passed at the time of detection — does not establish that those credentials remain active today.