CLAUDE CODE · TECH-202611-bvpxa6 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
When a Claude Code user approves a shell command with 'Yes, and don't ask again', Claude Code can store the exact command, including any password, token or key typed in it, in plain text in the project file .claude/settings.local.json. Claude Code only adds this file to the user's global git excludes on that one machine, never to the project's .gitignore, and Claude often commits the file itself. Apiiro (research published 5 Nov 2026) found 104,185 public copies on GitHub; 1,122 hold 1,379 secrets (379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens, 23 AWS keys) from 63 organisations, plus 734 more in git history, 211 forks and committed .claude/settings.json files: 2,539 secrets in 1,994 repos in total. One notified company confirmed its key was live. No reports of anyone abusing these secrets yet. Earlier bug reports (since 11 Aug 2025) were closed by a bot as 'not planned'; Anthropic has not responded and there is no fix.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Who cares technique
mysql -p database connection URLs, and SSH, AWS, GitHub, GitLab or npm tokens. gitleaks and TruffleHog miss many of these (neither flagged 215 of the 1,122 files)s .gitignore and your orgs .gitignore templates, and delete secret-containing rules from local copiesPosts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.