AI Coding Assistant Claude Code Leaks Passwords and API Keys to Public GitHub Repositories

Software security company Apiiro has revealed that Anthropic's AI coding assistant, Claude Code, can inadvertently expose sensitive information such as passwords and API keys. When developers use the 'Yes, and don't ask again' option, the assistant saves commands, including secrets, in a project settings file (.claude/settings.local.json). Apiiro found 1,122 public copies of this file on GitHub containing at least one secret, prompting a recommendation for immediate rotation of all exposed credentials.