FreeReport
Coding & Developer Tools
Vendor researchAuthor sells servicesCoding Agents Copy Your Secrets to a Hidden File. Thousands Are on GitHub
Apiiro reports finding 2,539 credentials matching its secret-classification rules in 1,994 public GitHub repositories, including values saved after Claude Code users approved commands with 'Yes, and don't ask again.' The research explains how settings, history and agent transcripts can retain credentials and recommends rotation, repository exclusions and command-aware scanning.
Why I recommend it: Apiiro did not use or test the credentials, so 'real secret' does not mean confirmed valid. Anthropic's Head of Claude Code said the team would prototype mitigations, including basic secret scanning.
#coding-agents#secret-management#github-security#claude-code