From Apiiro · · 1m 40s
Coding agents leak secrets on GitHub
GitHub secrets leak from AI tools as developers click 'don't ask again'.
In brief
GitHub secrets leak from AI tools as developers click 'don't ask again'. 2,539 real secrets were found in 1,994 public GitHub repositories after developers clicked 'don't ask again' on AI tools. Originally reported by Apiiro.
Secrets found in GitHub
Apiiro research found 2,539 real secrets in 1,994 public GitHub repositories.
“database passwords, cloud keys, api tokens, ssh root logins”
How secrets leak
Claude Code saves secrets to .claude/settings.local.json when users click 'don't ask again'.
“yes and don't ask again”
Public files with secrets
1,122 out of 104,185 public .claude/settings.local.json files hold real secrets.
“one in ten files over eight kilobytes holds a real secret”
Secrets in git history
1,160 more secrets found in git history across shared settings files and agent transcripts.
“the file was committed with everything else”
Who is affected
63 organizations including software companies and medical records systems have exposed secrets.
“a database vendor's own admin-level cloud key”
Real secret examples
Production Azure Postgres passwords and Square tokens were found in allowlists.
“production azure postgres password”
How many secrets
1,379 distinct secrets across 636 provider keys and 743 passwords or tokens.
“three hundred seventy-nine database passwords”
Scanners miss secrets
gitleaks and TruffleHog miss 215 files with passwords in commands.
“passwords inside commands are missed by scanners”
Other files with secrets
Agent chat transcripts and memory files also carry secrets in 87 repositories.
“one hundred twenty files in eighty-seven repos”
Malware collects secrets
Malware already collects credentials from developer machines in bulk.
“the shai-hulud npm worm ran trufflehog”
What to do
Untrack the file and rotate credentials to fix leaks.
“rotate every credential the file has ever held”
Security teams
Add agent folders to pre-commit and CI secret scanning.
“treat agent folders as secret-bearing”
Disclosure
One organization confirmed its key had been live.
“one company confirmed its key had been live”
Method and limits
Data collected from GitHub code search on November 1-3, 2026.
“all data came from read-only github code and commit search”
Prior work
Claude Code users reported the mechanism since August 2025.
“none got a reply from anthropic”
What happens next
Developers must rotate credentials and stop typing secrets into commands.
“reference them as $var from whatever secrets manager you use”
In short
2,539 real secrets were found in 1,994 public GitHub repositories after developers clicked 'don't ask again' on AI tools.
