Claude Code is accidentally exposing secrets all over GitHub

Researchers at Apiiro found thousands of credentials and secrets exposed in public GitHub repositories after developers uploaded their Claude Code installation folders, including the settings.local.json file where the AI coding agent stores credentials users approved it to remember. The exposed material includes passwords and API keys, and standard secret-scanning tools often fail to detect credentials stored in AI agent configuration files.