PANews：Claude Code settings file reportedly leaked 2539 real credentials
BIBIBI
AT A GLANCE
PANews, citing reports, stated that Claude Code configuration files in public GitHub repositories exposed 2539 real credentials, involving 63 organizations.
Article
Claude Code exposed for writing passwords into settings files, GitHub now has 2539 real credentials
PANews November 10 news, according to Ars Technica, security firm Apiiro discovered that more than 100000 Claude Code local settings files have been uploaded to public GitHub repositories. About 1100 of them contain database passwords, API Tokens, private keys, or root login information, involving 2539 real credentials across 1994 code repositories, affecting 63 organizations. After users choose "Yes, and don't ask again," the original command text containing keys may be written to .claude/settings.local.json and subsequently mistakenly committed to repositories. Boris Cherny from the Claude Code team said the team is researching preventive measures and considering adding in Claude Code ...
(Click the link below to read the full article)
🔗 https://www.panewslab.com/zh/articles/01a1c545-1d1a-7659-96b2-5a6153eeabce
Key points
01
PANews, citing a report by Ars Technica, stated that Apiiro discovered over 100000 Claude Code local configuration files uploaded to public GitHub repositories.
02
Reports indicate that approximately 1100 files contain database passwords, API Tokens, private keys, or root login information, involving 2539 real credentials across 1994 code repositories, affecting 63 organizations.
03
The possible path described in the report is: after the user selects "Yes, and don't ask again," the original command containing the key may be written to .claude/settings.local.json and subsequently mistakenly committed to the repository.
04
Boris Cherny of the Claude Code team said that the team is studying preventive measures; his subsequent statement was truncated in the provided text.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
This report describes the following: commands containing passwords or keys may be stored in local configuration files and then accidentally pushed to public repositories along with the code. The original text refers to this potential leakage path and does not state that all the credentials counted were leaked through the same path.
Why it matters to readers
According to reports, the exposed content includes not only ordinary settings but also passwords, private keys, and root login information, involving multiple organizations.
If using Claude Code, pay attention to whether .claude/settings.local.json contains sensitive information from commands, and whether it has been committed to a public repository; you cannot equate a "local settings file" with "containing no secrets."
Risks and unknowns
The provided text is a secondary citation and has been truncated, lacking the original research and complete reporting; the relevant statistics have not been independently verified.
The original text does not specify whether these credentials are still valid, whether they have been misused, or whether they have been dealt with.
The original text does not provide the complete content of the preventive measures, whether they have been implemented, or a specific timetable.
Related Developments
Loading event timeline…
Related concepts
API Token
This term is not in the glossary yet. Browse related concepts in the glossary.
