GitGuardian is the code security platform for the DevOps generation.

GitGuardian incident on November 9, 2026: This seems to be problem on Cloudflare side Started 4:41 PM UTC, resolved ongoing (● 7m). Affected: Website.

GitGuardian catalogued about 45 open-source frameworks that let AI agents run attacks. It found four that connect a secret scanner to the agent by default and many operator consoles exposed on the internet.

GitGuardian is the code security platform for the DevOps generation.

GitGuardian is the code security platform for the DevOps generation.

GitGuardian found 31,088 secrets in public Claude Code settings files and 613 in Docker Hub images, while Anthropic explores safeguards and UK guidance urges developers to isolate credentials.

GitGuardian reports 31,088 distinct secrets across 23,276 public GitHub repositories in .claude/settings.local.json files, 5,343 of them valid when detected, after Apiiro found the same pattern.

GitGuardian is the code security platform for the DevOps generation.

A configuration file meant to store local command permissions on Anthropic’s Claude Code is exposing thousands of API keys, database credentials and other secrets, according to findings by GitGuardian. The code security firm identified 31,088 distinct secrets in Claude Code’s “.claude/settings.local.json” files across 23,276 public GitHub repositories. Of those, 5343 were still valid when GitGuardian detected them. The exposed credentials include database connection strings, cloud provider tokens, SSH passwords, Google API keys, and AU service credentials. “Monthly leaks in settings.local.json peaked at 12,535 occurrences in April 2026, then fell to 959 by October, and we do not yet know what changed,” GitGuardian researcher Guillaume Valadon said in a blog post. Apart from source code repositories, the exposure included secrets embedded in publicly accessible Docker Hub images. The problem, Valadon explained, lies with how Claude Code handles command approvals. ## Command approvals turn into credential storage Claude Code asks developers for permission before executing certain shell commands. When a developer selects the “Yes, and don’t ask again” option, the tool saves an allow rule in .claude/settings.local.json, a project-level configuration file. The catch is that the saved rule contains the actual command string, including any credentials embedded in it. For instance, a developer asking Claude Code to interact with an API might approve a curl command containing an API key in its HTTP header. Claude Code then stores that entire command as an approved rule, leaving the credential in the configuration file. Although Claude Code automatically adds the file to its local Git ignore settings, that protection does not necessarily carry over to other machines or repositories, Valadon said. Developers can accidentally commit the file, particularly when working across different clones or when the file has already been tracked. Git Guardian found that 67% of the occurrences in settings.local.json for which it could establish validity were working credentials. Database identifiers accounted for the largest category of valid secrets, with 2280 distinct credentials, followed by cloud provider tokens and AI tokens. It was also noted that conventional secret scanners could miss a substantial portion of the exposure. Passwords embedded in command-line arguments and environment variable assignments often lack the recognizable formats that provider-specific detection rules look for. ## Leaked credentials on Docker Hub GitGuardian also examined public Docker Hub images and found 613 distinct secrets in Claude Code settings files, 99 of which were valid when detected. The credentials appeared across 543 image repositories and 7625 tags. According to Valadon, the problem arises when developers use Docker’s “COPY..” instruction to copy an entire project working directory into an image. Unlike Git, Docker does not automatically respect the repository’s .gitignore file. Consequently, a Claude Code configuration file excluded from version control can still be copied into a container image unless developers explicitly exclude it through .dockerignore. One valid Cloudflare API token appeared across 559 image tags, while a database password appeared in 643 tags across seven image repositories. Removing the offending file from the GitHub repository does not help the credentials already distributed through published images. Developers must rotate exposed credentials, remove sensitive configuration files from both Git and Docker build contexts, and check previously published images for lingering secrets. GitGuardian recommends treating AI coding assistant configuration files as potential secret-bearing assets, scanning them alongside conventional environment files, and using environment variables rather than hardcoding credentials into commands. Anthropic did not immediately respond to CSO’s request for comment. GitGuardian said Anthropic’s Claude Code lead Boris Cherny acknowledged the issue, saying the company was looking into it and exploring additional safeguards, including built-in secret scanning and an auto mode.

Secrets management for AI agents: why agents copy hardcoded secrets and pass your tokens along. Dwayne McDaniel of GitGuardian explains.

Secrets management for AI agents: why agents copy hardcoded secrets and pass your tokens along. Dwayne McDaniel of GitGuardian explains.

Has anyone heard anything about ARTEX being abused to grab leaked GitHub secrets? Info here from Microsoft: https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-too...

Claude Codeの確認画面で「Yes, and don’t ask again」を選んだ人は多いはずです。そうして保存されたルールに残った秘密情報を、セキュリティ企業2社が公開GitHubで数え、Git […]

Secrets management for AI agents: why agents copy hardcoded secrets and pass your tokens along. Dwayne McDaniel of GitGuardian explains.

A Sierra-style point-and-click adventure about getting the access, sign-offs and change window to fix a leaked secret with GitGuardian, without breaking production. Free, in your browser.

Microsoft Threat Intelligence caught attackers using an agentic AI framework, ARTEX, to hunt exposed secrets on public GitHub and move into Azure tenants in as little as five minutes. GitGuardian has ...

In this Help Net Security interview, Eric Fourrier, CEO of GitGuardian, talks about leaked credentials and personal liability for security leaders and boards. He explains how fear of blame pushes mistakes out of sight, and what a security leader should be ready to tell a CEO about exposed keys. He also covers better ways to measure security progress beyond alert counts, how to handle disclosure deadlines, and why AI tools and agents are creating new …

GitGuardian CEO Eric Fourrier on leaked credentials, blame culture, disclosure deadlines, and AI tools giving secrets new ways to escape.

GitGuardian is the code security platform for the DevOps generation.

GitGuardian が公開 GitHub 上の .claude/settings.local.json から 31,088 件のシークレットを検出、うち 5,343 件が検出時点で有効。「Yes, and don't ask again」で承認すると API キーを含むコマンド文字列がそのまま allow ルールとして保存されることが原因。Docker Hub イメージへの流出も確認。Claude Code 利用者は同ファイルの `.gitignore` 設定と既存コミットの確認が必要。

A Sierra-style point-and-click adventure about getting the access, sign-offs and change window to fix a leaked secret with GitGuardian, without breaking production. Free, in your browser.

GitGuardian is the code security platform for the DevOps generation.