By the Smili Phone team
One click in Claude Code can put a real password on the public internet, and researchers just showed how often it happens. Apiiro, a security company, published a report on November 5, 2026, after scanning public GitHub repositories. It found 1,122 copies of a Claude Code settings file holding a real secret: a database password, a cloud key, an API token, or a server login. The secrets sat in plain text, in files anyone on the internet can read.
How one click saves the secret
Claude Code is Anthropic's AI coding agent. When it needs to run a shell command, it asks for permission first. One of the choices is "Yes, and don't ask again." Pick it, and Claude Code saves that exact command as a permanent allow rule in a file called .claude/settings.local.json, inside the project folder. If the command carried a password, it is now in that file, word for word.
The file is supposed to stay on the developer's own machine. Claude Code tries to keep it out of version control: the first time it creates the file inside a git repository, it adds it to the global git ignore list. But that protection only helps if the file was never tracked before. Apiiro found that in the typical leaking repository, the file had been sitting there for 217 days.
What leaked
Apiiro scanned 104,185 public copies of the file across more than 103,000 repositories between November 1 and 3. Of those, 1,122 held at least one real secret, adding up to 1,379 distinct secrets. The list includes 379 database passwords and 122 service keys for Supabase, a popular database platform. Apiiro names stark examples: a database vendor's own admin-level cloud key, a production password for an Azure database, a live Square token, and the owner password for a medical records database. Sixty-three organizations are affected, most of them software companies.
Counting git history, the shared settings file teams commit on purpose, and saved agent chat transcripts, Apiiro puts the total at 2,539 secrets in 1,994 repositories. One in five of the files with a secret slipped past both standard secret scanners, gitleaks and TruffleHog, usually because the secret is a password typed inside a command, not a key in a recognizable format.
Check your own projects
If you or your team use Claude Code, search your GitHub organization for .claude/settings.local.json and .claude/settings.json. Every hit is a file anyone can read right now. If a file is already tracked, remove it from version control, add it to the repository's own .gitignore file, and rotate every secret it held. Treat anything that was ever in a public file as exposed, even if you delete the file later, because git history keeps old copies.
Going forward, never put a password inside a command you approve. Use environment variables or a secrets manager instead, and keep the "don't ask again" choice for commands that carry no credentials at all. Apiiro notes that this is Claude Code's own behavior, not the model's, and it reproduced the problem with the newest models. As of November 8, Anthropic has not replied publicly. The convenience of skipping a permission prompt is real, but so is the cost when the prompt was the only thing standing between a password and the public internet. If your team writes code with AI tools, bring your laptop by our shop in Escondido and we will help you check it.
Related: Your phone has a hidden security mode worth turning on · AI agents found 948 ways into Linux
