Security company Apiiro scanned GitHub and found 2,539 real and available credentials in 1,994 public code libraries, including database passwords and API Tokens. The source is the same thing: Claude Code's local settings file.
The mechanism is not complicated. Claude Code requires user approval before executing Shell commands. Approved commands will be written into the local settings file in the project directory, so there is no need to ask again next time. The problem is that many commands themselves carry keys, such as a database connection command that writes the password directly in the parameters. The command was written down as it is, and the file was not added to .gitignore. A single git add was pushed along with the project.
The scale is not small. More than 100,000 such settings files were transferred to public repositories, about 1,100 of which contained confidential data.
The Claude Code team responded by working on preventive measures and considering built-in key scanning.
To be fair, this does not count Claude "leaking" the key, but the user submitting the file containing the key. But the tool's default behavior is really digging a hole: it generates a file in the project directory that most people don't know exists and don't know what's in it.
Three things you can do now:
Open the .claude directory in your project and take a look at the allow list in settings.local.json to see if there are any commands with passwords or tokens.
Make sure this file is in .gitignore. It is more worry-free to add one to the global gitignore.
If it has already been pushed, deleting the file is useless as it is still in the history. Be honest and rotate keys.
This same problem is not limited to this family. Any programmed agent that "remembers your approved commands" is worth checking in the same way.