# Claude Code Settings Expose Credentials in 1,122 Public GitHub Files

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/52378
Published: 2026-11-09T15:08:45.000Z
Updated: 2026-11-09T15:08:45.000Z
Section: Technology

> The files held 1,379 distinct credentials, including 122 Supabase service keys. A broader review found 2,539 passwords across 1,994 repositories.

A scan of public GitHub repositories found 1,122 Claude Code settings files containing passwords or keys, showing how saved command approvals can carry credentials into shared project code.

The affected files accounted for about 1.1% of the 104,185 copies of .claude/settings.local.json examined. They contained 1,379 distinct credentials, including 379 database passwords, 122 Supabase service keys and 43 SSH credentials. Some of the SSH credentials were server root passwords. Credentials associated with 63 organizations appeared in the scan.

Claude Code can save a shell command as a standing permission rule when a user selects “Yes, and don’t ask again.” A command containing a database password, connection string or API key can therefore leave that information in the project’s local settings file.

When Claude Code creates the file inside a repository, it adds the file to the developer’s global Git exclusion list. That exclusion is local to the developer’s machine: it does not follow the project to another computer or remove a file already committed to Git. It also may not protect a folder that becomes a Git repository later.

The affected files had been in repositories for a median of 217 days. Older versions contained 734 passwords absent from current copies, while 211 forked repositories carried the same content. Including historical versions and other project files, the broader review found 2,539 passwords across 1,994 repositories.

The scan classified credentials by recognizable key formats or passwords appearing alongside public hosts. The researchers did not try to use each credential, so the findings do not establish that every one still worked. Organizations were notified Nov. 2 and Nov. 3; one confirmed that its exposed key was usable at the time.

In 539 of 1,105 repositories with exposed credentials, commits marking Claude as a co-author had changed a settings file. Anthropic Claude Code lead Boris Cherny said the file is meant to stay local and suggested that exposed copies had been created and uploaded manually.

Cherny said Claude Code had not previously filtered passwords. The team is considering safeguards, including checks in auto mode and basic secret scanning, and plans to prototype options. Removing a current file alone does not erase passwords retained in Git history or forked copies.