Claude Code Leak Exposes 2,539 Real Credentials

Security firm Apiiro discovered 2,539 real credentials—including database passwords and API tokens—in 1,994 GitHub repositories. Over 100,000 local configuration files for Claude Code were uploaded to public repositories, with approximately 1,100 of them containing sensitive data.

The issue stems from Claude Code writing permitted Shell commands to its local configuration files, which are then committed with the project if not properly ignored by Git. The team stated that they are investigating preventive measures and considering adding a built-in key-scanning feature.

Source: IT Home