Claude Code Is Accidentally Exposing API Keys and Secrets on GitHub

A security incident has emerged in which Claude Code, Anthropic's agentic coding tool, is inadvertently committing settings files containing sensitive secrets — including API keys and credentials — to public GitHub repositories. The issue stems from Claude Code's configuration files not being automatically gitignored, leading to thousands of exposed secrets across public repos. This is a significant operational security risk for any team using Claude Code in their development workflow, as exposed credentials can be exploited almost immediately by automated scanners. Developers using Claude Code should immediately audit their repositories for accidentally committed configuration files and rotate any exposed credentials. Adding Claude Code's settings files to `.gitignore` is an urgent remediation step until Anthropic issues a fix.