Anthropic's Claude Code Vulnerability Exposes Thousands of GitHub Secrets
A security vulnerability in Anthropic's Claude Code, identified by Apiiro Research, has led to the exposure of 2,539 real secrets across 1,994 public GitHub repositories. The issue stems from Claude Code's 'don't ask again' approval feature, which, when used to execute command-line commands containing secret keys, saves these keys in a `settings.local.json` file within the `.claude` directory. If developers then commit and push this directory to public GitHub repositories, these sensitive credentials—such as database passwords, API tokens, and SSH root logins—become publicly accessible. Apiiro's scan found that approximately 2% of all repositories containing `settings.local.json` files had this issue. This problem highlights a broader challenge in software development regarding what configuration data should be committed to version control versus what should remain local and private. While Claude now actively scans for secrets before commits, this vulnerability primarily affects older generations of Claude...
