What emerged
According to a report by IT之家, citing an investigation by Ars Technica published on November 9, the issue concerns how the coding agent Claude Code handles command authorizations. Researchers at security firm Apiiro identified more than 100,000 local settings files uploaded to public repositories; about 1,100 of them contained sensitive data such as database passwords, API tokens, private keys, or root access credentials.
By cross-referencing Git history, shared configuration files, and logs of conversations with the agent, the researchers reconstructed 2,539 real credentials spread across 1,994 repositories. The entities involved are reportedly 63 organizations, including student groups, startups, software agencies, and more established vendors. Among the exposed data, the material lists Azure database passwords, Square production tokens, root SSH access, and database-owner credentials for databases containing medical records.
The mechanism and reasons for the spread
The starting point, according to the reconstruction, is the prompt through which the tool asks whether to authorize the execution of a command. By selecting the option that stops further requests for that instruction, the rule is saved in the project's local configuration file, together with the command text: the latter may include passwords, tokens, or keys typed into it.
Such a file should remain outside version control thanks to a globally configured exclusion, but this setting does not always apply to the individual repository. The risk increases if a project is cloned to another computer or if a common folder is converted into a Git repository later on. The material also reports that the tool can sometimes include changes to the settings file in a commit without user confirmation. The research also indicates a correlation between the size of the permissions list and the presence of secrets: very large files are more exposed than small ones.
Previous cases and announced measures
This is not an isolated report. According to the source, as early as August 2025 some bug reports had highlighted that the settings file might not be correctly excluded from version control, or that sensitive commands could end up in unprotected files; those reports are said to have been closed after 60 days of inactivity.
On November 7, Boris Cherny, a member of the Claude Code team, responded on Hacker News: he said that countermeasures are being studied and that the settings file should not be under version control. He also recommended using key-scanning tools to clean up sensitive data and said that integrating a scanning feature directly into the tool is being explored.
The timing and manner of the announced fixes and the actual scope of the identified cases remain to be verified: the available material is based on Apiiro's research and the team's statements, without independent confirmation or details on the individual repositories involved. The question of forks also remains open, as they can retain the credentials even after removal from the original repository.
