Claude Code is accidentally exposing secrets all over GitHub
Summary
Security researchers found that Claude Code settings files uploaded to public GitHub repositories are inadvertently revealing sensitive credentials. These exposed secrets include API tokens, root logins, and database passwords. The security flaw originates from how the system handles configuration files.
Claude Code is leaking sensitive information on public GitHub instances thanks to a partial oversight in the way its settings files are handled. That's the finding of AI security researchers at Apiiro, who discovered thousands of secrets, including database passwords, API tokens, and root logins, amid Claude Code settings files embedded in GitHub repositories. The leak stems from the way…
Source: Read the full story at Ars Technica - All content