Claude Code leaks passwords in GitHub files
The gist
Security firm Apiiro found 1,122 public GitHub files holding 1,379 secrets saved by Anthropic's Claude Code.
The files stayed public for months, so exposed keys may still be live.
How it unfolded
- Aug 11, 2025A bug report was filed saying approved commands with API keys and tokens were being stored word for word in settings.local.json.
- Jan 3, 2026The original bug report, number 5544, was marked "not planned" after 60 days of inactivity.
- Apr 2026Check Point-owned Lakera found credentials in 33 such files across 30 packages published to the npm registry.
Key terms
- GitHub
- A repository is a storage space on GitHub where developers keep and manage their project's code and files.
- terminal agent
- AI programs that can make decisions, pursue goals, and take actions independently, often used for coding tasks.
- npm registry
- The default package manager and online repository for JavaScript packages, used with the Node.js runtime environment.
Source: Wikipedia