GitGuardian published a scan of public GitHub and Docker Hub on November 9, 2026, counting 31,088 distinct secrets in Claude Code approval files across 23,276 repositories and 11,336 authors, with 5,343 of them still valid when detected.<\/p>\n\n\n\n
.claude\/settings.local.json<\/code>, including any API keys or passwords typed in the command<\/li>- Who is affected:<\/strong> 23,276 public GitHub repositories and 543 Docker Hub image repositories, with 1,955 valid Postgres connection strings among the leaked credentials<\/li>
- What to do:<\/strong> Rotate every secret ever held in approval files, add
.claude\/<\/code>, .cursor\/<\/code>, .gemini\/<\/code>, .codex\/<\/code>, .mcp.json<\/code> and CLAUDE.md<\/code> to .gitignore<\/code> and .dockerignore<\/code>, and scan repository history<\/li>- Status:<\/strong> No fix had shipped from Anthropic when GitGuardian published on November 9, 2026<\/li>
- Root cause:<\/strong> Answering Yes, and don’t ask again to a shell command prompt makes Claude Code save the full command as typed, so credentials inside the command are written to disk<\/li><\/ul>\n\n\n\n
In plain English<\/h2>\n\n\n\n
Claude Code is an AI coding assistant that asks permission before running shell commands. When you click Yes, and don’t ask again, it saves the entire command exactly as you typed it, including any passwords or API keys. Researchers found over 31,000 secrets sitting in these approval files on public GitHub, and more than 5,000 of them still worked. If you use Claude Code or similar AI coding tools, you need to check your repository history for leaked credentials and change them, then make sure the approval files are in your .gitignore<\/code> and .dockerignore<\/code>. If you don’t use these tools, you can ignore this.<\/p>\n\n\n\nWhat happened<\/h2>\n\n\n\n
GitGuardian published a scan of public GitHub and Docker Hub on November 9, 2026, counting 31,088 distinct secrets in .claude\/settings.local.json<\/code> across 23,276 repositories and 11,336 authors, with 5,343 of them still valid at detection. Apiiro reported the same exposure pattern days earlier with a smaller, conservatively filtered count and no validity check. No fix had shipped from Anthropic when GitGuardian published.<\/p>\n\n\n\nAnswering Yes, and don’t ask again to a shell command prompt makes Claude Code save that approval as an allow rule holding the full command as typed, so an API key or a password inside the command is written to disk. Anthropic’s own documentation says Claude Code adds the file to the user’s global git excludes the first time it writes it, which means a repository that already tracks the file, or a file the developer created by hand, is not covered.<\/p>\n\n\n\n
Container images built with COPY . .<\/code> ship the working tree, so git-ignored files travel into the image unless .dockerignore<\/code> excludes them. GitGuardian scans every public commit as it is pushed, so its count includes versions later deleted or force-pushed away.<\/p>\n\n\n\nOther agent files leak too<\/h3>\n\n\n\n
GitGuardian found secrets in multiple agent configuration files:<\/p>\n\n\n\n
.claude\/settings.json<\/code>: 8,271 distinct secrets across 6,839 repositories, 1,283 valid<\/li>CLAUDE.md<\/code>: 6,155 distinct secrets, 2,537 valid<\/li>.claude\/.credentials.json<\/code>: 1,366 tokens<\/li>.codex\/auth.json<\/code>: 1,064 tokens<\/li><\/ul>\n\n\n\nOn Docker Hub, 543 image repositories and 7,625 tags carried 613 distinct secrets, 99 of them valid.<\/p>\n\n\n\n
Who is affected<\/h2>\n\n\n\n
Database credentials are the most valuable of what leaked: 1,955 distinct valid Postgres connection strings, plus valid SSH passwords, MongoDB URIs and Google, Telegram, Resend and DeepSeek keys.<\/p>\n\n\n\n
Personal email domains account for 15,993 distinct secrets and corporate or custom domains for 5,924 across 3,338 domains, with education, research and software services making up about three-quarters of matched organizations.<\/p>\n\n\n\n
What you should do<\/h2>\n\n\n\n
Rotate every secret an approval file has ever held, because deleting the file does not revoke the credential. Add .claude\/<\/code>, .cursor\/<\/code>, .gemini\/<\/code>, .codex\/<\/code>, .mcp.json<\/code> and CLAUDE.md<\/code> to .gitignore<\/code> and .dockerignore<\/code> and remove credential-bearing rules through \/permissions<\/code>.<\/p>\n\n\n\nReference secrets as variables and approve narrow command prefixes rather than broad ones such as Bash(curl:*)<\/code>.<\/p>\n\n\n\nTreat .claude\/<\/code>, .cursor\/<\/code>, .gemini\/<\/code>, .codex\/<\/code>, .mcp.json<\/code> and CLAUDE.md<\/code> as secret-bearing like .env<\/code>, and scan them at pre-commit, in CI, in git history and in container registries.<\/p>\n\n\n\nHow to check your repository<\/h3>\n\n\n\n
Search your repository history, not only the files at the current commit, because GitGuardian’s companion lab test found just 2 of 9 planted credentials sitting at HEAD. Scan .claude\/settings.local.json<\/code>, .claude\/settings.json<\/code>, .claude\/.credentials.json<\/code>, CLAUDE.md<\/code> and .codex\/auth.json<\/code>, then extend the same scanning to any container image built from the working tree.<\/p>\n\n\n\nWhat it means<\/h2>\n\n\n\n
GitGuardian reports that Claude Code lead Boris Cherny said on Hacker News that the team is investigating, that Claude Code has not historically scrubbed secrets, and that an auto mode and built-in secret scanning are being prototyped. Until then, approving a command that contains a credential writes it to disk.<\/p>\n\n\n\n
Deleting the file revokes nothing, so rotate every credential it ever held first. GitGuardian scans each public commit as it is pushed, which means its count includes secrets that authors later deleted or force-pushed away, and anyone watching the same stream could have captured them.<\/p>\n\n\n\n
GitGuardian also calls its own validity figures floors, because detectors without a checker were not counted as valid. The two researchers measured differently: GitGuardian scans every public commit as it is pushed, catching versions later removed, and ran read-only validity checks on its detections. Apiiro used a conservative filter and did not test whether the secrets still worked.<\/p>\n\n\n\n
Sources<\/h2>\n\n\n\n