What happened?
Security firm Apiiro reported a serious leak on GitHub caused by the config file of Anthropic's coding assistant Claude Code. According to the firm, a total of 2,539 valid secrets were exposed across 1,994 public repositories.
Why it matters
The exposed data includes credentials such as passwords and access keys. When such information is published in public repositories, it becomes easier for malicious actors to reach accounts and systems.
Scanners miss some leaks
Apiiro highlights that some of the leaks cannot be detected even by existing security scanners. In other words, standard checks are not always enough.
What users should do
Developers using Claude Code should check their config files and secret keys before pushing projects to public repositories. Additional scanning steps are recommended to make sure credentials haven't slipped into repositories.
