TORONTO, Nov. 14, 2026 — A single convenience click in Claude Code turned standing approvals into public credentials. Research published November 5 by Apiiro's Shmulik Cohen and Matan Giladi shows that when a developer approves a Bash command in Claude Code with "Yes, and don't ask again," the tool saves the full approved command, secret included, as an allow rule in .claude/settings.local.json, a file inside the project folder.

Apiiro scanned public GitHub data collected November 1 to 3 and found 104,185 public copies of that file across 103,617 repositories. Of those, 1,122 copies, about 1.1 percent, held at least one real secret, 1,379 distinct secret values in total. The contents included 379 database passwords, 122 Supabase service-role keys, 103 Supabase account tokens, 43 SSH logins for public servers, 42 GitHub, GitLab and npm tokens, and 23 AWS keys. Widening the search to git history, the shared settings file teams commit on purpose, and saved agent chat transcripts, the count rose to 2,539 distinct secrets across 1,994 repositories and 63 organisations, mostly software companies.

The exposure is not a breach of Anthropic's infrastructure. It is a feature working as designed. Claude Code tries to keep the file out of git by adding it to the developer's global git excludes the first time it writes it in a repository, but that protection is fragile. Apiiro traced commits that changed the settings file and found Claude-coauthored commits in 539 of the 1,105 repositories it examined. In many cases the agent itself moved the file into version control.

Secret scanners were no safety net either. Of the 1,122 files holding a real secret, gitleaks flagged 564 and TruffleHog flagged 643, and 215 were flagged by neither, usually because the secret is a password typed inside a command rather than a recognisable key format. Apiiro did not test the credentials it found, so the research shows exposure risk rather than demonstrated compromise, but at least one organisation it notified confirmed that the key it flagged was still live.

No CVE has been issued and no patch was cited in the reports. Anthropic's head of Claude Code, Boris Cherny, said in the discussion that followed the report that Claude Code has not historically done secrets scrubbing and that the team is looking into what it can do to prevent this.

"The lesson is not that developers should stop using coding agents," said Sarah Reid of Securetron. "It is that an agent which holds credentials in plain text on a developer machine, and saves them as part of its own allowlist, turns a convenience click into a lasting secret. The fix is structural: provider keys should live server-side and be injected when a request is forwarded, so the endpoint agent never holds them at all."

That is the model AI-FW, Securetron's self-hosted AI firewall and governance gateway, is built around. AI-FW sits between AI agents and the models they call, storing provider keys in its model registry and injecting them on forward, so agents that talk directly to a model never need to hold a key. Every prompt and response passes through guardrails that detect jailbreaks and prompt injection, mask PII, and block data exfiltration, with semantic intent scoring, per-agent identity and risk profiles, and a metadata-only audit log. The gateway is fail-closed by design: a scanner error or missing configuration blocks the request rather than forwarding it unfiltered.

The AI-FW Community Edition is free to use and proprietary, not open source, with 10 billion tokens per rolling 30 days and no credit card required. It runs in the customer's own environment, on premises or in their cloud, so traffic never needs to leave their network.

About Securetron

Securetron builds AI-FW (https://aifw.io), a self-hosted AI firewall and governance gateway between AI agents and LLM backends, and PKI Trust Manager (https://securetron.net), an enterprise certificate lifecycle management platform. Securetron is based in Toronto, Canada.

Press Contact:
Sarah Reid
Securetron
1 Yonge St, Toronto, ON M5E 1E6, Canada
+1 (438) 927-8036
[email protected]
https://aifw.io