Research published by Apiiro on November 5, 2026 identifies a credential-exposure problem in coding-agent configuration files. The central example is a command approval saved in Claude Code’s local settings: if the command contains a literal password or token, the saved permission can contain it too.
What the research measured
Apiiro reports finding 2,539 distinct apparent secrets across 1,994 public GitHub repositories, counting local and shared settings, history, and other agent artifacts. Its collection ran November 1–3. The researchers explicitly say they did not test credentials or contact the associated hosts. Their classification identifies values matching provider formats or credential context; it does not prove every value remained valid.
The report’s mechanism is important independently of the count. A file intended for one developer’s local preferences can become public if it is tracked and committed. Removing the current file does not remove older commits, forks, or copies already downloaded.
What the product documentation establishes
Anthropic’s documentation separates shared project settings from project-local overrides. The shared settings file is meant to travel with a repository; the local file is intended for one developer. A standing Bash approval can be recorded as an allow rule in that local file.
The documentation says Claude Code adds its local file to a global Git excludes file when it first writes it under the applicable conditions. It also explains that developers who create the file themselves should ignore it. An ignore rule does not retroactively remove a file already tracked by Git. The difference between intended scope and actual repository state therefore matters.
The response is not a shipped repair
On November 7, Claude Code team member Boris Cherny responded in the linked Hacker News discussion. He said the team was investigating prevention, including possible secret scanning approaches. The discussion describes work to explore, not evidence that a specific protective update had already shipped. Apiiro updated its report on November 8 to include that response.
A practical repository review
Our security analysis is to treat agent settings and generated notes as potentially sensitive build inputs. Review what Git actually tracks, including relevant history, rather than relying on a filename containing “local.” Check archives, packaged source, and container build contexts as well as the public repository.
If an exposed credential is found, revocation or rotation is the first containment step. Repository cleanup cannot make an already copied credential private again. Coordinate that work with the service owner so dependent applications receive the replacement safely, and examine provider access records for misuse.
For prevention, keep secret values in a credential system and pass references where the workflow supports them. Evaluate scanners against passwords embedded in ordinary command arguments as well as recognizable API-key formats. A scan that detects one familiar token prefix is not proof that all command-based credentials are covered.
Finally, inspect the saved approval itself after a sensitive operation. Human approval to execute a command and permission to preserve its contents indefinitely are different decisions. This research makes that distinction concrete for teams adopting coding agents.