Research from Apiiro found over a thousand public settings files holding real credentials, traced to a convenience feature in the coding agent.
VentureBeat reports that security firm Apiiro found 1,122 publicly accessible Claude Code settings files containing real credentials, including database passwords, cloud service keys and tokens for other systems. The issue traces to Claude Code's "don't ask again" permission option, which can save the full approved command, secrets included, into a local settings file; if that file ends up in a public GitHub repository, its contents become readable to anyone. A broader search covering historical file versions and other AI tool outputs turned up 2,539 distinct credentials across 1,994 public repositories, spanning 63 organizations.
Apiiro said it did not test whether the exposed credentials still worked, though one organization confirmed that an exposed key had been active. Anthropic's head of Claude Code, Boris Cherny, said the team is exploring built-in scanning for exposed credentials and additional safeguards in the automated permission system, without announcing a specific fix or release date. Apiiro recommends scanning repositories and git history for the settings file, rotating any exposed credentials, adding the file to .gitignore templates, and referencing secrets as environment variables instead of typing them into commands.
Why it matters: as AI coding agents become standard in enterprise development, convenience features that cache approved commands can just as easily cache the secrets inside them, making agent permission settings and repository hygiene a frontline part of enterprise AI and cloud security, not an afterthought.