RealFeedApp Apiiro researchers found thousands of secrets in Claude Code settings
Apiiro researchers found that Claude Code saves passwords and API tokens in local settings files that can be uploaded to public GitHub repositories. The issue is exacerbated because user consent to run commands is stored within these files.
- Field
- computer security
- What they did
- Security researchers found that Claude Code accidentally exposes sensitive information like passwords and API tokens on public GitHub instances through its settings files.
- Why it matters
- This leak allows attackers to gain access to user accounts and databases if their local settings files containing credentials are compromised or shared publicly.
#claude code#github#security leak#api tokens#ai safety
