GitGuardian says it found 31,088 distinct secrets in Claude Code settings files on public GitHub, including 5,343 that passed its validity checks when detected.
The security firm's analysis, published on 9 November 2026, covers public commits from January 2025 to 7 November 2026. It also found 613 secrets in public Docker Hub images, 99 of which passed its checks. These figures include credentials in versions later deleted or removed from repositories.
Apiiro's Earlier Scan Found 1,379 Secrets in Settings Files
The findings follow research published by application security firm Apiiro on 5 November. Apiiro found 1,379 secrets in 1,122 of 104,185 public copies of Claude Code's .claude/settings.local.json file on GitHub.
Apiiro's broader total was 2,539 secrets across 1,994 repositories. That figure includes Git history, shared settings, transcripts, memory and handoff files, and VS Code Copilot auto-approve settings.
The totals are not directly comparable. Apiiro did not test whether its identified credentials still worked, while GitGuardian monitored public commits over a longer period and says 5,343 of its 31,088 secrets passed an automated, read-only validity check when detected. That does not establish that they remain active today.
Claude Code Saves Approved Commands in a Project File
Anthropic's documentation says choosing 'Yes, and don't ask again' for a Bash command saves an approval rule in .claude/settings.local.json. If the saved command contains a password or token, the credential may also appear in that rule.
The file is intended for an individual developer's use. When Claude Code first writes it in a Git repository that does not already ignore it, the tool adds an exclusion to that user's global Git configuration; a manually created file must be added to .gitignore by the developer.
That exclusion is tied to the user's Git setup, not the project. It may not protect a file already tracked, copied to another environment or committed by someone without the same exclusion. Apiiro found Claude-co-authored commits changing the file in 539 of 1,105 repositories it traced, but that does not establish Claude introduced or published every credential.
Claude Code Lead Says Team Is Exploring Changes
Boris Cherny, head of Claude Code, wrote in the Hacker News discussion that the team was 'looking into what we can do to prevent this'. He said Anthropic would prototype possible approaches, including secret scanning and changes to auto mode, but did not announce a fix or release date.
When a commenter pointed out that sensitive commands could still be saved in auto mode, Cherny replied, 'Yeah good catch.' Participants differed over whether responsibility lies mainly with developers who commit files or tools that save command approvals; the discussion represents individual reactions, not a survey.
UK Guidance Advises Keeping Secrets Away From AI Coding Tools
For UK developers and organisations using Claude Code, the relevant question is whether a settings file or its Git history contains a credential that remains active.
UK government guidance advises keeping secrets separate from AI coding assistants and using additional vulnerability scanning. GitGuardian's Docker Hub findings also show why checking Git alone may not cover every route: files copied into a public container image can carry credentials even when excluded from version control.
