Claude Code settings files expose thousands of secrets on GitHub

Reported by Ars Technica (Kyle Orland)

Summary by Cyber Security News9 Nov 2026, 18:24 CET

About this summary. This is a short excerpt from the description that Ars Technica published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/

Claude Code is leaking sensitive information on public GitHub instances thanks to a partial oversight in the way its settings files are handled. That's the finding of AI security researchers at Apiiro, who discovered thousands of secrets, including database passwords, API tokens, and root logins, amid Claude Code settings files embedded in GitHub repositories. The leak stems from the way Claude Code handles user approval for automated shell commands.

Read the full article at Ars Technica →

Source attribution: headline and facts are from Ars Technica (arstechnica.com). Summary method: excerpt of the source description. See our source attribution policy.