Claude Code Settings Files Leak Secrets to GitHub

On November 10, 2026, Ars Technica reported that Apiiro security researchers found that Claude Code's local settings files were being uploaded in large numbers to public GitHub repositories, leading to secret leaks. The researchers counted about 1,100 files from 63 organizations containing sensitive credentials such as API tokens, database passwords, and private keys. These settings files were meant to stay on developers' local machines but were leaked after being accidentally committed to public repositories. The incident is still under investigation and disclosure, and the report did not mention the specific list of affected organizations or follow-up handling measures by the parties involved.

AI overview of reporting · Updated 2 h前

Not enough continuous observations to show a trend yet.