Claude Code Settings Files Leak Thousands of Secrets on GitHub

What Happened

Claude Code configuration files committed to public GitHub repositories have exposed thousands of API keys, tokens, and other credentials, per reporting from Ars Technica. The exposure originates from users checking in settings files that persist credentials in plaintext, often as part of local project scaffolding that was never intended for version control. The affected files include settings artifacts that Claude Code writes or reads during normal operation, meaning the leak is a byproduct of standard tooling behavior rather than a targeted attack.

Why It Matters

The exposure is operational rather than theoretical: credentials committed to public repositories are scraped continuously by automated bots, typically within minutes of a push. Teams that have adopted Claude Code without a corresponding secrets hygiene practice now hold live risk in their repositories, including cloud provider keys, model API credentials, and internal service tokens. The blast radius extends beyond the developer who committed the file — a leaked key can compromise billing accounts, downstream infrastructure, and any system the credential authenticates against. For organizations running Claude Code across multiple squads, the problem is multiplicative: every repository is an independent exposure surface, and audit coverage is rarely uniform. This is a current, actionable security issue, not a forward-looking concern.

Technical Details

The leak stems from settings files that store configuration and credentials in plaintext on disk, which developers commit alongside project code without recognizing the sensitivity of the contents. Because these files often carry names and paths that resemble ordinary configuration, standard .gitignore templates do not reliably exclude them, and many repositories were created before the risk was understood. Public GitHub exposes full commit history, so deleting a file in a later commit does not remove the credential from the repository's history or from third-party forks and scrapers that already captured it. Rotation is therefore mandatory for any key that touched a public repository — repository cleanup alone is insufficient. Detection requires scanning both the working tree and the commit history, and tooling that understands the specific file formats and key patterns involved performs better than generic regex-based scanners.

Operational Impact

The immediate workflow change is a repository audit across every project that has used Claude Code, followed by credential rotation for anything exposed. Teams should add secret-scanning to CI and pre-commit hooks that block commits containing credential patterns, so the control operates before the push rather than after. .gitignore templates and repository scaffolding need explicit entries for Claude Code settings artifacts, and onboarding documentation should treat local config persistence as a security-sensitive step. Expect a short-term spike in rotation work and scanner tuning, followed by a durable shift toward treating developer-tool config as part of the secrets perimeter. Organizations without centralized repository inventory will find the audit slower and less complete than those with it.