investigation
About 1,100 of those files contain database passwords, API tokens, private keys or root login information.
A investigation by Apiiro. Statements are as reported by the cited publishers — not verified by DecisionGateway.
其中约 1100 份含有数据库密码、API Token、私钥或 root 登录信息
Discussion
Related claims
The exposure involves 2,539 real credentials across 1,994 code repositories and affects 63 organizations.Apiiro · investigationMore than 100,000 Claude Code local settings files have been uploaded to public GitHub repositories.Apiiro · investigationThe flaws could potentially expose private data, passwords, and website servers.THnewsupdates · allegationWAF and REST API request logs should be checked.turansecurity · commitmentBecause authentication checks in the Repository commits API are insufficient, a remote unauthenticated attacker can read arbitrary files on the server, including configurations, tokens, keys and credentials.Turan Security xavfsizlik byulleteni · allegationSPH Media was hit by a data breach affecting 9% of its database.biztimes · statement
More claims by Apiiro
After a user selects "是，且不再询问", command text containing secrets may be written into .claude/settings.local.json and then mistakenly committed to repositories.allegationThe exposure involves 2,539 real credentials across 1,994 code repositories and affects 63 organizations.investigationMore than 100,000 Claude Code local settings files have been uploaded to public GitHub repositories.investigation
All claims by Apiiro