Claude Code leaked 1379 secrets: AWS keys and database passwords ended up in public repositories

It's a familiar story: a convenient feature becomes a security hole because nobody checks exactly what it writes to disk. This time, it involves Claude Code. According to Apiiro researchers, public GitHub repositories contain 1122 copies of the agent's settings file, in which they found 1379 secrets: database passwords, API tokens, AWS keys and other credentials.

How secrets end up in the settings file

Claude Code asks for permission before running a command in the terminal. When you click “always allow,” it saves a rule in a settings file inside the project. The problem is that the rule is saved as is, including the command's arguments.

Imagine asking the agent to connect to a database and running a command with the password passed directly on the command line. Or running curl with a token in a header. You approve it permanently, and the entire line, password included, ends up in the file. Then habit takes over: git add, commit, push. The file sits in the project folder, and many people don't know it's there or what it contains.

As a result, the secret lives somewhere nobody thinks to check, rather than in an .env file that everyone has long since learned to add to .gitignore. It's a classic blind spot: security tools and team habits are geared toward familiar files containing secrets, rather than an AI agent's configuration.

Why this is more serious than a typical leak

Bots constantly scan public GitHub repositories. An AWS key exposed in a public repository is usually put to use within minutes: for mining, spam or data access. Even if you delete the file in the next commit, the secret remains in git history.

Apiiro's figures appear to be only a lower bound: the researchers found what was visible through search, while private repositories and forks were not included in the sample. Any agentic tool that remembers approved commands faces the same risks, including Cursor, Codex CLI, Gemini CLI and others.

What to do right now

First: check your repositories. Find the Claude Code settings folder and review the list of allowed commands. Any line containing a password, token or key is a reason to act.

Second: if a secret could have ended up in a public repository, treat it as compromised. Simply deleting the file is not enough; revoke the key and issue a new one. Cleaning git history helps, but it does not guarantee that nobody has already taken a copy.

Third: add the agent's local settings file to .gitignore and integrate a secrets scanner into pre-commit and CI. Gitleaks, TruffleHog or GitHub's built-in push protection can catch these things before publication.

Fourth: don't pass secrets on the command line. Use environment variables, secrets managers or short-lived tokens so that the saved permission rule contains nothing valuable. And don't click “always allow” for commands with sensitive arguments.

Limitations

The source here is a post on X linking to Apiiro's research; we have not seen the full report. It is unknown how many of the 1379 secrets were active and how many had already been revoked or were test credentials. It is also unclear whether Anthropic will change this behavior, for example by masking arguments in saved rules or warning about the risk of committing the file.

But the practical takeaway does not depend on those details. AI agents create new files containing incidental data, and established security habits do not cover them. Check your repositories today, before the first AWS bill arrives.