Cybersecurity
1122 passwords and keys found in open GitHub repositories via Claude Code settings file
Apiiro security company announced that due to a vulnerability in Claude Code assistant, sensitive data is stored in open repositories.
Apiiro software security company revealed that a security vulnerability was identified in Claude Code, an artificial intelligence assistant developed by Anthropic. Due to this security flaw, passwords and API keys entered by developers are left in open GitHub repositories.
According to data provided by the company, a total of 1122 open repositories were found to contain such sensitive information. This situation arises when users choose the "Yes, and ask me later" option when confirming commands via Claude Code. In this case, the system saves the command text, including hidden secret keys, verbatim in the project settings file.
As a result, passwords and keys in commands confirmed by developers remain in a state where anyone can read them in open repositories. This security vulnerability demonstrates that it can lead to the uncontrolled spread of sensitive information.
This is a translated editorial summary. Refer to the original source for the complete announcement.