Claude Code GitHub Secret Leaks: GitGuardian's 31,088

If you searched for Claude Code GitHub secret leaks this week, you probably found the Apiiro report: 1,122 public settings files with real secrets. A second, larger count landed four days later. GitGuardian published its own analysis of the same file on November 9 and the numbers are an order of magnitude bigger, because it asked a different question. This post is what the second report adds and what to change before Monday. The mechanism itself is in our earlier breakdown of the Apiiro findings, so this one skips the basics.

What GitGuardian says#

All figures below are from GitGuardian's write-up (vendor research, read in full November 13, 2026).

• 31,088 distinct secrets in .claude/settings.local.json on public GitHub from January 2025 through November 7, 2026, across 23,276 repositories and 11,336 authors. 5,343 were valid when detected. The shared .claude/settings.json adds 8,271 secrets, 1,283 valid.
• Why it differs from Apiiro. Apiiro's 1,379 counts what sits in current copies today with a conservative filter and no validity check. GitGuardian scans every public commit as it is pushed, so it also sees versions later deleted or force-pushed away. GitGuardian's own framing: the second number is the count of credentials that should have been rotated.
• Database credentials are the live ones. The volume is curl commands with bearer tokens, but the valid secrets skew to databases: 1,955 distinct valid Postgres connection strings and 292 valid SSH passwords in settings.local.json.
• The scanner gap. GitGuardian says 63% of occurrences are generic detections (passwords, high-entropy strings, JWTs, bearer tokens). A password after PGPASSWORD= has no provider prefix to match, which is consistent with Apiiro's finding that gitleaks and TruffleHog miss roughly one in five leaking files.
• Docker Hub. Public images carry these files across 543 image repositories and 7,625 tags: 613 distinct secrets, 99 valid. One valid Cloudflare API token appears in 559 tags of a single image.
• A falling curve. Monthly leaks peaked at 12,535 in April 2026 and fell to 959 in October. GitGuardian says it does not know why and lists candidates (a prompt change, adoption flattening, push protection, its own detector coverage).

The angle: gitignore protects the git index, not the build context#

The Apiiro story was about GitHub. The Docker Hub half is the part most teams have not modelled. Claude Code keeps the file out of git on your machine, but a Dockerfile with COPY . . copies the working directory, and git's ignore rules do not apply to it. Per GitGuardian, 72% of the image copies sit under /app, /workspace or /usr/src, which matches a repo copied wholesale into an image. The fix is a line in .dockerignore, not in .gitignore.

The second consequence is retroactive. One committed file rebuilt into every tag is why 99 valid secrets show up as 109,284 occurrences in images. Deleting the file from the repo does nothing for images already pushed. Rotation is the only real cleanup, which is the same conclusion as in our guide to keeping API keys away from coding agents.

There is also a vendor-risk reading. GitGuardian sells monitoring and agent hooks, and its post ends with a product pitch. The data is still checkable in kind (you can audit your own repos), but treat the headline totals as vendor-reported.

What to do Monday#

GitGuardian's remediation list, with commands. The git and jq commands are standard, and I have not run them against an affected repo, so check the output before relying on it.

1. Rotate first. Any credential that was ever in the file is burned. History, forks and images keep copies.
2. List what you approved. Run /permissions in Claude Code, or jq -r '.permissions.allow[]' .claude/settings.local.json in each repo, and delete every rule that contains a secret.
3. Check history. git log --all --oneline -- .claude/settings.local.json tells you whether it was ever committed.
4. Ignore it in the repo itself. Add .claude/settings.local.json to the repo .gitignore and add .claude/ to .dockerignore. The global ignore Claude Code writes does not travel with a clone. See three ways to ignore files in git.
5. Use variable names in commands. GitGuardian's advice: reference $N8N_API_KEY so the saved rule stores the name, not the value. It notes the value can still reach the transcript if the shell echoes it.
6. Narrow the prefix. Prefer a rule scoped to one host over Bash(curl:*), which approves any curl, including one written by a prompt injection. Our permissions guide covers precedence.
7. Scan images and CI, not just repos. Include .claude/, .cursor/, .codex/, .mcp.json and CLAUDE.md in pre-commit, CI and registry scans. GitGuardian found CLAUDE.md holds 6,155 distinct secrets, the highest validity rate of any file it checked.

What people are actually saying#

Reaction on the Hacker News thread about the Apiiro research (paraphrased) carries over to this one:

• The headline is misleading. One commenter pointed out that clicking the button does not itself publish anything: the secret leaks only when a settings file with a typed-in secret is committed and pushed. That is accurate, and it is why the fix is ignore rules plus not typing secrets into commands.
• Env var habit. Another commenter suggested never putting the literal secret on the command line, adding the file to a global gitignore and running a pre-commit scanner such as gitleaks. GitGuardian's data adds a caveat: generic scanners miss the bare-password cases.
• Anthropic's reply. Per press coverage of the thread, Claude Code lead Boris Cherny said the team is looking into prevention, that auto mode and built-in secret scanning are being prototyped, and that Claude Code ignores the file when it creates it. Commenters were not all convinced: one said they distrust being steered toward auto mode and prefer reviewing every edit, and another reported that Claude fails at writing permission hooks.
• The counter-case. The 92% fall since April suggests the problem may be shrinking by itself, and these are still a small fraction of public repos. Apiiro's own rate was about 1.1% of the 104,185 copies it examined. Against that, 5,343 working credentials is the number a defender cares about.

The takeaway#

A permission allow list is a log of what you typed, and typing secrets into commands is the habit to break. The new lesson from GitGuardian is that the leak surface is wider than GitHub: Docker images and CI caches take the working tree, not the git index. Treat .claude/ like .env, ignore it in the repo and in .dockerignore, and rotate anything it ever held.

Continue Reading#

• Claude Code settings.local.json Secrets: Check Your Repos - the Apiiro findings and a 10-minute cleanup
• How to Keep API Keys Away From Your AI Coding Agent - file rules, env scrubbing and credential masking compared
• Claude Code Permissions: settings.json Allow, Deny, Ask - rule syntax and precedence
• Coding Agent Hooks: Fail Open vs Fail Closed - why a secret-scanning hook that fails open is a gap
• Three Ways to Ignore Files in Git - repo, local and global ignore
• Claude Code tool page - what the CLI does, pricing and setup links

Sources#

• GitGuardian: Claude Code settings.local.json Secrets: 17 months of exposure on GitHub and Docker Hub - primary research, November 9, 2026 (vendor research, read in full November 13)
• Apiiro: Coding Agents Copy Your Secrets to a Hidden File. Thousands Are on GitHub - the first analysis, November 5, 2026 (cited via GitGuardian and press coverage, figures as reported)
• Hacker News discussion - community reaction and the Anthropic reply
• Ars Technica: Claude Code is accidentally exposing secrets all over GitHub - coverage including the scanner gap