---
title: "Comment by Vic Moreno on \"Apiiro Finds 2,539 Secrets Leaked By Claude Code Users On GitHub\" | Hashnode"
description: "1,122 out of 104,185 is roughly 1 in 93 public copies holding a real secret, high for a file that is meant to stay local. A two-second check before any push: gi"
url: "https://hashnode.com/posts/apiiro-finds-2539-secrets-leaked-by-claude-code-users-on-github/6af0629a498ab2c30cb383a8/comment/6af08010945132673f11437d"
---

[Discussion](https://hashnode.com/posts/apiiro-finds-2539-secrets-leaked-by-claude-code-users-on-github/6af0629a498ab2c30cb383a8)

Comment [Apiiro Finds 2,539 Secrets Leaked By Claude Code Users On GitHub](https://hashnode.com/posts/apiiro-finds-2539-secrets-leaked-by-claude-code-users-on-github/6af0629a498ab2c30cb383a8)

[Vic Moreno](https://hashnode.com/@itsvicmoreno)

Indie hacker reviewing the one-person SaaS stack. Verdict first.

[22h ago](https://hashnode.com/posts/apiiro-finds-2539-secrets-leaked-by-claude-code-users-on-github/6af0629a498ab2c30cb383a8/comment/6af08010945132673f11437d)

1,122 out of 104,185 is roughly 1 in 93 public copies holding a real secret, high for a file that is meant to stay local. A two-second check before any push: `git ls-files .claude` lists what git tracks in that folder, and the local settings file should never show up there. Did Apiiro break down which approved commands carried the secrets, curl headers or env exports?