Dek: Nobody breached Anthropic. People committed a settings file that was never meant to leave the laptop, and the credentials inside it went public with the repo.
What the Claude Code secrets leak actually is
Ars Technica reported on November 9 that Claude Code settings files are exposing thousands of secrets in public GitHub repositories. Cybernews covered the same finding the same day, framing it as AI agents leaking credentials. GitGuardian's write-up names the file: settings.local.json.
Start with what this isn't. Anthropic wasn't hacked, and Claude Code wasn't compromised. Nobody broke into a server and walked out with a database, because the exposure came from inside people's own projects.
Not a breach.
That distinction matters because it decides who has to act. Anthropic can add a default ignore rule, and a rule would help. But a public token is already public, and the fix runs through your machine, not theirs.
Why settings.local.json ends up in a public repo
The file lives inside the project folder, which is the whole problem. Anything in the project folder looks like project code to git, and git does what it's told.
Claude Code keeps per-project configuration in there: allowlists for commands you've approved, environment values, and definitions for the MCP servers you've connected. Some of those entries hold credentials, because a tool that talks to a service needs a key to talk to it.
Now consider the routine. You're scaffolding a project at 1 a.m., you run git add -A because you want everything in one commit, and the settings file rides along. One push later, a Docker Hub token sits in a public repo with your name on the commit.
GitGuardian's analysis points at Docker Hub credentials specifically, which is the detail that should raise your heart rate. A container registry key can pull private images, and in some configurations it can push over them.
How to check your own Claude Code GitHub security today
Search before you read further. GitHub's code search accepts a filename query, and a search for the settings file across public repos is the fastest way to see whether your account shows up.
Then look locally. Run git log on the file path in each project you've pushed in the last year, and check whether the name appears in any commit. If you use a monorepo, check the subdirectories too.
The third check is the one people skip. Look at what's actually inside the file, and note every value that could act as a credential: registry tokens, cloud keys, service passwords, personal access tokens for GitHub itself.
Then check your .gitignore. If the settings file isn't listed, add it today. That doesn't clean up history. It stops the next commit from making things worse.
Why deleting a commit doesn't undo a Claude Code secrets leak
Rewriting history feels like a fix. It isn't one, and treating it as the whole remedy is how a small leak becomes a long one.
Public repos get cloned, forked and archived. GitHub's search index caches content, and so do the crawlers that security researchers run. A token that spent six hours on a public branch may already sit in three datasets you'll never see.
So rewrite history if you want the repo tidy, and rotate the credentials regardless. Those are two jobs, and only one of them protects anything.
One more mechanism worth knowing. Deleting a file in a later commit leaves the blob in the object database, and anyone who knows the commit hash can still read it.
Hiding isn't revoking.
Rotation order after a Claude Code settings.local.json exposure
Rotate in order of blast radius, not convenience. The sequence below assumes you found one or more live-looking credentials in a public repo.
Start with container registries and anything that can push artifacts. A registry key can overwrite an image that other systems pull, which turns a credential problem into a supply chain problem.
Next, cloud provider keys. Scope a replacement to the narrowest policy that still does the job, then confirm the old key is disabled rather than deleted and forgotten. Deletion can leave a window where an attacker's cached session keeps working.
Then the smaller stuff: API keys for SaaS tools, webhook secrets, and any personal access token tied to your GitHub account. Revoke, reissue, update the config, and check the provider's audit log for use you don't recognize.
The AI agent secret leak angle makes this more urgent than a normal token spill. Agent configs tend to hold several credentials at once, because an agent that browses, deploys and queries needs a key for each. One file, many doors.
What's still unknown about the Claude Code secrets leak
How many of the exposed credentials were still live when researchers found them? Ars Technica's reporting supports a figure of thousands of secrets, which isn't the same thing as a count of keys that still open a door. A revoked token and an active one look identical in a repo listing.
How many repositories are affected, and whether the same handful of organizations accounts for most of them, is a question the public reporting leaves open. No breakdown has been published, and naming victims on thin evidence would be reckless.
And whether Anthropic ships a default ignore rule, a warning on first commit, or nothing at all. The company hasn't said. Until it does, the .gitignore line is yours to write.
Do that part now. Open your biggest project, check whether the settings file is tracked, and fix the ignore list before your next commit. Two minutes of housekeeping beats a rotation scramble at midnight.
