Coding Agents Copy Your Secrets to a Hidden File. Thousands Are on GitHub

What it is

Apiiro reports finding 2,539 credentials matching its secret-classification rules in 1,994 public GitHub repositories, including values saved after Claude Code users approved commands with 'Yes, and don't ask again.' The research explains how settings, history and agent transcripts can retain credentials and recommends rotation, repository exclusions and command-aware scanning.

Why I recommend it

Apiiro did not use or test the credentials, so 'real secret' does not mean confirmed valid. Anthropic's Head of Claude Code said the team would prototype mitigations, including basic secret scanning.

Topics

#coding-agents #secret-management #github-security #claude-code

Added Nov 9, 2026 · 0 opens