Claude Code can commit secrets to public repos: what is documented

Claude Code, Anthropic’s command-line coding agent, can stage and commit .env files, API keys, SSH keys and other credentials to a public repository, and this can happen silently during autonomous sessions, according to a community hardening guide for the tool. The documented mechanism is ordinary catch-all staging with git add . or git add -A, not the tool’s saved permission approvals.

That distinction matters because claims are circulating that commands saved through Claude Code’s “don’t ask again”-style approvals have carried passwords into public GitHub files. None of the sources reviewed for this article contains that finding, a file count, or the name of a researcher behind it. What the sources do show is two separate things: developers worn down by repeated permission prompts, and a concrete, reproducible way secrets end up in commits. This piece covers what is documented and how to guard against it.

How Claude Code ends up committing secrets

The cc-safe-setup guide describes the path plainly. Claude Code “frequently uses git add . or git add -A“ to stage all changes. Those commands add every modified or new file in the working directory that is not excluded by .gitignore, the file that tells git which paths to ignore. If that file is incomplete, or if Claude itself created a new file containing credentials, the secrets get staged and committed.

The guide points to a specific report, Claude Code issue #16561, as an example. In that case, during a refactoring session, Claude ran git add ., which picked up a newly created config file containing API keys, and the commit was pushed to a public repository.

The guide lists the kinds of material at risk:

• .env files and API keys
• SSH keys and other credentials
• Credential files such as .netrc, .npmrc and .cargo

The key phrase in the guide is “silently during autonomous sessions”. When the agent is allowed to run git commands without a human reviewing each one, nobody looks at the staged file list before the commit lands.

Why developers grant the agent more autonomy

Claude Code asks permission before many actions, and some users find the volume unworkable. In issue #24305, opened on February 9, 2026, a developer reported that when asked to research a topic, Claude Code requested permission for each search or link, “resulting in needing to click yes sometimes upwards of hundreds of times with no way to just accept all”. The reporter asked that users be able to “just allow it once instead of a hundred times” and marked the problem as a regression from a previous version.

An automated bot on the repository found three possible duplicates, including issue #11380, titled “Claude continually asks for permission, even after selecting yes, always allow,” and #22557, “Critical: Claude Code ignores explicit user instructions to stop asking permission”. Issue #24305 was closed as a duplicate of #11380 on February 12, 2026, and locked on February 19.

These reports show a real usability pressure: users want broad, persistent approvals so they can stop clicking. They do not, by themselves, show that those approvals store or leak secrets. The sources leave the connection unproven. The reasonable reading is narrower: the more an agent runs without per-action review, the more the staging problem described in the cc-safe-setup guide can go unnoticed.

Earlier Claude Code issues that exposed keys or code

Secret exposure in Claude Code has come up before through different routes. A community security guide published in the everything-claude-code repository says that on February 25, 2026, Check Point Research published a Claude Code disclosure. The guide describes two issues from it:

• CVE-2025-59536 (CVSS 8.7, a standard severity score out of 10) allowed code contained in a project to execute before the user accepted the trust dialog.
• CVE-2026-21852 allowed API traffic to be redirected through an attacker-controlled ANTHROPIC_BASE_URL, leaking the API key before trust was confirmed.

“All it took was that you clone the repo and open the tool,” the guide’s author writes. The same guide argues that in an agentic system, prompt injection (instructions hidden in content the model reads) “can become shell execution, secret exposure, workflow abuse, or quiet lateral movement”.

A separate incident involved Anthropic’s own packaging. Penligent’s security blog reports that public posts on March 31, 2026 said Claude Code’s npm-distributed CLI exposed enough source map metadata for outsiders to reconstruct readable TypeScript source, with GitHub mirrors claiming to derive from cli.js.map for version 2.1.88. Penligent notes that Anthropic’s changelog shows 2.1.88 as a real release dated March 30, 2026. It is careful to add that the evidence supports a packaging exposure, “not the same as a confirmed breach of Anthropic’s cloud systems,” and not proven disclosure of customer repositories, prompts or local files.

Issue	What was exposed	Source
Catch-all git staging	Users’ .env files, API keys, SSH keys pushed to repos	Community hardening guide
CVE-2026-21852	User’s Anthropic API key, via redirected traffic	Community security guide citing Check Point Research
CVE-2025-59536 (CVSS 8.7)	Code execution before trust was accepted	Community security guide citing Check Point Research
Version 2.1.88 source map	Anthropic’s own CLI source, reconstructable	Penligent Security Blog

How to block secret staging in your own setup

The cc-safe-setup guide’s main fix is a Claude Code hook, a script that runs before a tool call and can block it. Its secret-guard.sh reads the command Claude is about to run and checks it against two patterns:

1. Direct staging of sensitive file types: git add on files ending in .env, .pem, .key, .p12, .pfx or .jks, which it blocks with the message “BLOCKED: Staging sensitive file”.
2. Catch-all staging: git add . or git add -A, which it blocks with “BLOCKED: Use specific file names instead of git add .”.

When either pattern matches, the script exits with code 2, which stops the command. The effect, per the guide, is that “Claude is forced to stage files individually, making accidental secret inclusion much less likely”. Note the wording: less likely, not impossible. A file containing a key but named something ordinary, staged by name, would pass this check.

The guide packages this hook with seven others, installable with npx github:yurukusa/cc-safe-setup. The bundle also targets rm -rf deletion, force-pushes to main or master, credential file exposure and syntax errors cascading through files. The project says it has more than 240 test files and 734 examples. It also offers npx cc-health-check, a free 20-point diagnostic for a Claude Code setup, which needs jq installed. These are community tools, not Anthropic products, and should be reviewed before installation like any script that runs on every command.

Checking what is already in a repository

The sources focus on prevention and do not give a procedure for finding or removing secrets that have already been pushed. A practical starting point that follows from the guide is to look for the file types its hook guards against (.env, .pem, .key, .p12, .pfx, .jks, .netrc, .npmrc) in tracked files and in commits made during agent sessions, and to confirm .gitignore covers them, since an incomplete .gitignore is one of the two causes the guide names.

What this means for teams building with coding agents

The wider lesson in the security guide is that an agent’s risk grows with what it can touch. “If your agent has root access, or broad filesystem access, or useful credentials loaded, you are compromised” once an injection succeeds, its author writes. The guide cites Simon Willison’s “lethal trifecta” framing, which identifies private data, untrusted content and external communication as the dangerous combination. A coding agent with credentials in its working directory and permission to push to a remote holds at least two of those.

The guide also points to GitHub’s coding-agent design as a model of constraint: only users with write access can assign work, lower-privilege comments are hidden from the agent, hidden characters are filtered, pushes are constrained and workflows still need a human to approve them. Teams running Claude Code locally carry those decisions themselves.

For builders, the practical takeaways from the sources are:

• Treat catch-all staging by an agent as a risk, especially in autonomous sessions.
• Keep credentials out of the directories an agent works in where possible, given how prompt injection can turn into secret exposure.
• Assume that convenience settings which reduce prompts also reduce human review; the sources show the demand for fewer prompts is strong.

What remains unconfirmed

The specific claim behind this thread, that saved approvals themselves have written passwords into public GitHub files, has no supporting document among the sources reviewed. There is no count of affected files, no named researcher, no method and no response from Anthropic in that material. Until such a report is available, it should be treated as unverified. The documented, reproducible risk is the git staging path.

What to watch next

• Whether a researcher publishes a method and data showing secrets stored in persisted Claude Code approvals, which would make this a distinct leak path from the staging problem.
• Any response from Anthropic, including changes to how Claude Code stages files by default or how it handles the permission complaints tracked in issue #11380.
• Further disclosures in the vein of the Check Point Research findings, which show secret exposure can come from the tool’s own trust model as well as from user workflows.
• Updates to community hardening tools such as cc-safe-setup, which already tracks newer Claude Code hook features such as the hook if field from version 2.1.85.