Security firm Apiiro has reported 2,539 exposed secrets across 1,994 public GitHub repositories, including database credentials, SSH logins and cloud keys, and warned that a Claude Code permission option can store passwords and API keys in plaintext.
AI coding tools · Credential security
Exposed secrets in public code, and a plaintext storage warning for Claude Code
A security report found 2,539 exposed secrets across 1,994 public GitHub repositories. It also warns that a Claude Code permission option, "Don't Ask Again," can save passwords and API keys in plaintext.
2,539
exposed secrets, including database credentials, SSH logins and cloud keys
1,994
public GitHub repositories where those secrets were found
Plaintext
storage risk flagged for passwords and API keys saved via the "Don't Ask Again" option
Exposed secrets vs. affected repositories
Column height is proportional to each count. Both are raw totals from the report.
1,994
Public repositories
Roughly 1.3 exposed secrets per affected repository. The report does not say how many came from the Claude Code setting.
Why deleting a secret is not enough
The commit history keeps earlier versions of the code.
→
→
Step 3
Still in Git history
→
What the report establishes
Passwords and API keys can be stored in plaintext via the "Don't Ask Again" option.
Credentials in public repositories can grant access to systems, data or infrastructure.
Removing a committed file does not remove the credential from Git history.
What the reporting does not say
How many of the 2,539 secrets came from Claude Code.
Any response from Anthropic.
Whether the findings measure the feature's direct impact.
Practical takeaway
Treat any credential that has entered Git history as compromised until it is revoked.
Review how Claude Code stores permissions and credentials.
Avoid approving commands that embed secrets in configuration files.
Check existing repositories for committed keys.
Keep secrets in dedicated secret managers or environment variables.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article...