Claude Code Leak: 31,088 Passwords and API Keys Exposed on GitHub

The facts in 30 seconds

• What happened: Claude Code stores every permanently approved command as a plaintext allow rule in a project file. If the command contained a secret, the file now does too.
• How it went public: the file travelled with projects to GitHub, into npm packages and into Docker images.
• Scale: 31,088 secrets, 5,343 valid (GitGuardian, 9 November 2026). 2,539 secrets in 1,994 repositories (Apiiro, 5 November 2026).
• What leaked: mostly database credentials, plus SSH passwords, cloud keys, GitHub and npm tokens, and AI service API keys.
• Claude-specific? Partly. Of 16 coding agents Apiiro compared, only Claude Code writes the full approved command to a project file by default. Other agents leak through other files.
• Anthropic's response: Claude Code lead Boris Cherny reportedly said on Hacker News that the team is looking into it, that Claude Code has not historically scrubbed secrets, and that built-in secret scanning is being prototyped. No fix had shipped as of 11 November 2026.
• Not to be confused with the 31 March 2026 incident, when Anthropic accidentally published Claude Code's own source code.
• Your obligation: a valid database credential exposing personal data may trigger a breach notification under Article 33 GDPR within 72 hours.

What happened in the November 2026 Claude Code leak

Claude Code is Anthropic's terminal coding agent. Before running a shell command it asks for permission, offering a one-time approval or "Yes, and don't ask again". The second option writes an allow rule to .claude/settings.local.json in the project folder, so the same command runs without asking next time.

The problem is the shape of that rule. What gets stored is the command itself, character for character. A pattern seen thousands of times: a developer lets the agent query a database, the command carries a connection string with user and password, and the developer clicks "don't ask again". From that moment the database password sits in plaintext in a file next to the source code.

Claude Code adds the file to the machine's global git excludes the first time it writes it. That safeguard is real, but it does not travel: it fails when the folder becomes a repository later, when git already tracks the file, on another machine, in CI, in container builds and in npm packaging. The Cloud Security Alliance summarised these gaps in a research note dated 8 November 2026.

The result: the file went public via git add ., npm publish and COPY . .. In 263 repositories Claude itself was the git author of the leaking commit, meaning Claude Code or its GitHub Action committed the file on the user's behalf.

How many secrets did Claude Code leak? The numbers

Two security firms measured independently with different methods. Both figures are correct; they answer different questions.

Apiiro (report, 5 November 2026) took a point-in-time snapshot between 1 and 3 November:

• 104,185 public copies of settings.local.json checked, 1,122 with at least one real secret, 1,379 distinct secrets.
• Including git history, forks and the shared settings.json: 2,539 secrets in 1,994 repositories.
• 734 secrets survived only in history, in repositories that had already deleted the file.
• Breakdown: 379 database passwords, 122 Supabase service-role keys, 43 SSH logins (some with root passwords), 42 GitHub, GitLab and npm tokens, 23 AWS keys.
• Gitleaks and TruffleHog together missed 215 of the 1,122 files, mostly passwords embedded in command syntax.
• The median leaking file had sat on the default branch for 217 days.

GitGuardian (analysis, 9 November 2026) monitors public commits continuously and validated what it found:

• 31,088 distinct secrets in settings.local.json across 23,276 repositories, 5,343 valid at detection.
• Largest valid family: database credentials, 2,280, including 1,955 valid Postgres connection strings and 292 valid SSH passwords, followed by cloud provider keys (971) and AI service tokens (583).
• Docker Hub: 613 secrets in public images, 99 valid; a single valid Cloudflare token appeared in 559 image tags.
• Timeline: first leaks in June 2025, a peak of 12,535 occurrences in April 2026, then a 92 % drop to 959 in October. GitGuardian does not know what changed.

So the widely quoted "2,539 passwords" is imprecise: it is 2,539 secrets of all kinds from Apiiro's snapshot, with passwords as the largest group. GitGuardian's broader measurement is more than ten times higher.

Not the same incident: the March 2026 source code leak

Search for "Claude Code leak" and most results describe a different event. On 31 March 2026, version 2.1.88 of Claude Code's public npm package shipped a 59.8 MB source map from which the tool's source code could be reconstructed, roughly 513,000 lines of TypeScript according to Zscaler. That incident exposed Anthropic's intellectual property, not user data.

For enterprises the November secrets leak matters more. These are your database passwords, your cloud keys and your tokens. And unlike the source code leak, you can act on it yourself.

Anthropic's fault or the users'?

Both, and the answer tells you where to intervene. The files were committed by people or agents, not published by Anthropic. Boris Cherny, who leads Claude Code at Anthropic, made that argument according to GitGuardian and iTnews: Claude Code gitignores the file when it creates it, so exposed copies were likely created manually and committed.

GitGuardian disagrees on one point: in all of the roughly 3,000 occurrences it inspected, the secret sat in an allow rule of exactly the shape the permission prompt writes. Nobody typed them by hand. And Apiiro compared 16 coding agents from their documentation: Claude Code is the only one that writes the full approved command to a project file by default.

For your organisation the blame question is secondary. The finding is what counts: a tool developers use every day stores credentials in plaintext on a convenient default action, and its only safeguard works on the one machine where it was set. That is a governance problem, not an individual developer's mistake.

According to Cherny, Anthropic is prototyping built-in secret scanning and an auto mode, which may not fully solve the problem. Earlier reports on the same topic, such as issue #5544 from August 2025 on plaintext credential storage, were closed automatically without a maintainer response, according to the CSA.

Not only Claude Code: what other AI coding agents leak

GitGuardian counted the config files of 30 coding agents on GitHub. All of them leak, mostly the same way: MCP server definitions with API keys in plaintext. Only Claude Code's file is dominated by credentials typed into commands and then persisted.

• CLAUDE.md, the agent's instruction file: 6,155 secrets, 2,537 valid, the highest validity rate of any file studied.
• .claude/.credentials.json, the agent's own Anthropic login: 1,366 tokens in 371 repositories, because entire home directories were committed.
• OpenAI Codex, .codex/auth.json: 1,064 tokens in 536 repositories.
• npm packages: Lakera, a Check Point company, found credentials in 33 files across 30 published packages.

The lesson goes beyond one tool: agent folders are as sensitive as `.env` files and must be treated that way in git, packages, images and backups. For the wider threat model, see our guide to LLM security and the OWASP LLM Top 10.

Convenience features turning into data exits is not a one-off: researchers also showed how the ChatGPT Lockdown Mode could be bypassed, OpenAI's own setting against data exfiltration.

Check now: is your repository affected?

For a single repository the check takes minutes. For an organisation with many repositories it belongs in a managed process.

1. Find the file, including history: git log --all --oneline -- .claude/settings.local.json. Any hit means the file was committed at least once.
2. Read it: review the allow lists in .claude/settings.local.json and .claude/settings.json for passwords, tokens, connection strings, Authorization headers and -p flags of database clients.
3. Check CLAUDE.md and other agent folders, including .cursor/, .codex/ and .gemini/ where used.
4. Check packages and images: npm pack --dry-run shows what a package would contain. In Docker, COPY . . copies the working tree, not the git index, so ignored files ship too.
5. Scan organisation-wide, including forks and archives, with a custom rule for passwords inside command lines. Default rules miss exactly these.

Immediate actions, in this order

The order is the most important part. Deleting the file first feels safe and is not.

1. Rotate first. Change or revoke every password and key the file ever held. Clones, forks and Docker images keep their copies; deleting or rewriting history does not remove them. Start with database, SSH and package-publishing tokens.
2. Check access. For every valid finding, review logs for unfamiliar logins since the file's first commit.
3. Remove the file from git: git rm --cached .claude/settings.local.json, then add it to the project's own .gitignore, not only the global one. Add .claude/ to .npmignore and .dockerignore.
4. Defuse the rules. Delete every allow rule containing a real secret. Pass credentials via environment variables or a secrets manager so the command contains $DB_PASSWORD, not the password.
5. Narrow patterns, not full commands. Use pattern rules such as Bash(npm run test *) for low-risk commands. No standing approvals for curl, ssh or database clients.
6. Govern centrally. Where Claude Code is rolled out across the company, use managed settings: deny rules blocking access to .env files and secrets directories, plus sandboxing for shell commands.
7. Pre-release gate. A build step that fails whenever agent configuration ends up in a package or image.

Claude Code security and compliance for European enterprises

For EU companies a leaked database password is not just a technical problem. Three checks belong in the assessment of every finding.

GDPR. If the credential was valid, public and opens a database containing personal data, this may be a personal data breach. Article 33 GDPR then requires notifying the supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals. Document that assessment even when it concludes against notifying.

NIS2. For entities in scope of NIS2, an exploited credential can be a significant incident with an early warning to the national CSIRT or authority within 24 hours. An exposed but demonstrably unused key usually is not, but the check belongs in the process.

Data flowing to the vendor. Independent of the leak: every command, file and query result a cloud agent processes goes to the provider's servers. With US providers the CLOUD Act applies. Teams handling customer data, trade-secret source code or regulated data need a sound legal basis and a data processing agreement. See our guide to GDPR-compliant AI.

A Claude Code alternative for enterprises: the ADVISORI CLI

Many teams will keep using Claude Code, and with the measures above that is defensible. For organisations that need a coding agent with guardrails and compliance built in, rather than bolted around a cloud tool afterwards, we built the ADVISORI CLI. It combines three components that already exist on their own:

• Models in European data centres. The CLI runs on our private LLM service in our own data centres, together with our infrastructure partner Yorizon, a joint venture of HOCHTIEF and Thomas-Krenn. Your source code and commands never leave the EU: no US provider in the data path, no CLOUD Act exposure.
• Fugi Guardrails on every call. Every request passes through Fugi Guardrails: prompt-injection checks, masking of personal data and logging, operated in a German data centre under a GDPR Article 28 data processing agreement.
• Open coding models instead of a black box. The service's catalogue includes coding models such as Qwen3 Coder 480B and Kimi K2.7 Code, with no dependency on one vendor's pricing or product decisions.

To be clear: no tool makes a password inside a command safe. The rules in this article apply to every agent, ours included. The difference lies in where data is processed, who sets the guardrails, and whether your auditors can trace the chain.

Who it is for: mid-sized companies and enterprises in regulated sectors (banking, insurance, critical infrastructure, industry with sensitive know-how), teams working on trade-secret code, and anyone whose data protection officer has so far said no to US coding agents. If you want to try it on one of your own repositories, we will scope the use case, model choice and integration in a 30-minute call.

Conclusion

The November 2026 Claude Code leak is not a breach at Anthropic. It is the result of a convenient default: one click on "don't ask again" writes credentials in plaintext to a project file, and a safeguard that works on a single machine does not stop it from travelling. More than 31,000 secrets, over 5,000 of them valid, show how often that happened.

The response has two layers. Short term: rotate, check, and keep the file out of git, packages and images. Long term: treat coding agents like any other privileged software, with centrally governed rules, clear data sovereignty and a chain your auditors can verify. If you are looking for a Claude Code alternative with built-in guardrails and European operation, that is what the ADVISORI CLI is for.

Updates

• 11 November 2026: First published. Status: Anthropic is looking into countermeasures, no fix has shipped. We will update this article when that changes.

Frequently asked questions

What is the Claude Code leak?

In November 2026 Apiiro and GitGuardian showed that Claude Code saves permanently approved shell commands verbatim to .claude/settings.local.json, including any passwords and API keys they contain. Thousands of these files ended up in public GitHub repositories, npm packages and Docker images. This is separate from the 31 March 2026 incident, when Anthropic accidentally published Claude Code's source code.

How many secrets did Claude Code leak?

GitGuardian counts 31,088 distinct secrets in 23,276 public repositories, 5,343 of them valid when detected. Apiiro found 2,539 secrets in 1,994 repositories in a narrower snapshot, with 379 database passwords as the largest group.

Was Anthropic hacked?

No. The credentials belong to users and were published with their projects. The cause is a tool default: approvals are stored in plaintext, and the git exclusion only applies on the machine where it was set.

How do I check whether my repository is affected?

Run git log --all --oneline -- .claude/settings.local.json to see whether the file was ever committed. Then review the allow lists in settings.local.json and settings.json for passwords, tokens and connection strings, and check CLAUDE.md, published npm packages and Docker images.

Is deleting the file enough?

No. Clones, forks and Docker images keep their copies, and rewriting git history does not remove them. Rotate or revoke every secret the file ever held first, then remove the file from git and add it to the project's own .gitignore.

Has Anthropic fixed the problem?

As of 11 November 2026 no fix has shipped. Claude Code lead Boris Cherny reportedly said on Hacker News that the team is looking into it and prototyping built-in secret scanning, which may not fully solve it.

Is Claude Code still safe to use?

Yes, with discipline and central governance: no secrets in commands, credentials via environment variables, no standing approvals for curl, ssh or database clients, .claude/ in .gitignore, .npmignore and .dockerignore, managed settings with deny rules, and a secret scan before every release.

Does this affect Cursor, Codex and other AI coding agents?

Partly. According to Apiiro only Claude Code writes the full approved command to a project file by default. But GitGuardian found leaking config files for all 30 agents it studied, mostly API keys in MCP server definitions, and 1,064 OpenAI Codex login tokens in 536 repositories.

Is a leaked API key a reportable GDPR breach?

It depends on what the credential opens. If a valid, public credential allows access to personal data, it may be a breach under Article 33 GDPR, reportable within 72 hours unless a risk to individuals is unlikely. Document the assessment either way.

What is a good Claude Code alternative for enterprises?

For regulated organisations three criteria matter: where the models run, who sets the guardrails, and whether the chain can be audited. The ADVISORI CLI runs on our private LLM service in European data centres with partner Yorizon and checks every call with Fugi Guardrails, with open coding models such as Qwen3 Coder available.