Apiiro Finds 2,539 Secrets Leaked By Claude Code Users On GitHub
Security company Apiiro found 2,539 real secrets across 1,994 public GitHub repositories, including credentials in Claude Code settings files, git history, shared settings and agent transcripts. Key T
Responses
Markdown supported · ⌘↵ to post
Vic Moreno
Indie hacker reviewing the one-person SaaS stack. Verdict first.
1,122 out of 104,185 is roughly 1 in 93 public copies holding a real secret, high for a file that is meant to stay local. A two-second check before any push:
git ls-files .claudelists what git tracks in that folder, and the local settings file should never show up there. Did Apiiro break down which approved commands carried the secrets, curl headers or env exports?