Fix Claude Code Password Exposure in GitHub Repositories

What Causes This Issue

Claude Code, Anthropic’s command-line coding agent, includes a Don’t Ask Again option that suppresses permission prompts for file operations. When enabled during sessions involving sensitive files — such as .env configurations, SSH keys, or API token stores — the tool may write those secrets into its own session logs or temporary output files. Developers who subsequently commit their project directories to public GitHub repositories inadvertently push those artifacts, exposing credentials to anyone cloning the repo.

Researchers identified 1,122 public GitHub files containing live secrets traced to this behavior. The leak occurs because Claude Code’s local history mechanism stores command context, including file reads and writes, in plaintext within the user’s home directory. If a developer runs git add . or similar broad staging commands, those hidden logs ride along into version control.

Users in the Apple Support Community report this affects macOS developers using Homebrew or direct binary installs of Claude Code. The issue compounds when gitignore rules omit the tool’s hidden directories, typically ~/.claude-code/ or project-level .claude/ folders.

Step-by-Step Fixes

1. Rotate every exposed credential immediately. Treat each leaked token, key, or password as compromised. Generate new secrets in the issuing service (AWS, GitHub, Stripe, database consoles) and revoke the old ones. Do not wait to audit — rotate first.
2. Remove sensitive files from Git history. Use git filter-repo or the older git filter-branch to purge the offending blobs from all commits. Example: git filter-repo --path ~/.claude-code --invert-paths. Force-push the rewritten history to GitHub with git push --force-with-lease.
3. Add Claude Code directories to global gitignore. Create or edit ~/.gitignore_global and append:
   .claude-code/
.claude/
claude-code.log
   Then run git config --global core.excludesfile ~/.gitignore_global.
4. Disable “Don’t Ask Again” for sensitive operations. In Claude Code’s interactive prompt, never select the persistent allow option when the tool requests access to .env, .ssh/, *.pem, or any file containing secrets. Re-enable per-request approvals in the tool’s settings file (~/.claude-code/config.json) by setting "persistentPermissions": false.
5. Scan your repository for residual secrets. Run git secrets --scan-history or trufflehog git file://. --since-commit=HEAD~100 to confirm no credentials remain in reachable history.
6. Enable GitHub secret scanning and push protection. In each affected repository’s Settings > Security > Secret scanning, turn on both Push protection and Validity checks. This blocks future commits containing recognized token patterns.

Additional Solutions

Adopt a pre-commit hook that runs a secret detector on every staged change. Tools like detect-secrets or ggshield integrate with pre-commit frameworks and catch leaks before they leave your machine. Configure the hook to scan for high-entropy strings, AWS keys, GitHub PATs, and database URLs.

Use a dedicated credentials manager such as 1Password CLI, Bitwarden CLI, or macOS Keychain via security command instead of plaintext .env files. Reference secrets at runtime through environment variable injection (op run --, bw get password) so they never touch disk.

Containerize development environments with devcontainers or orbstack on macOS. Mount only the source code into the container; keep Claude Code’s logs and config inside the ephemeral container filesystem, which is excluded from git by default.

Audit GitHub Actions workflows that may have cached compromised artifacts. Check actions/cache entries and workflow logs for leaked values. Invalidate and regenerate any deployment keys or service account tokens used in CI pipelines.

Consider switching to Claude Code’s –no-persist flag (if available in your version) which disables local session logging entirely. Verify with claude-code --help or the official changelog.

When to Contact Apple Support

This issue originates in third-party software (Claude Code) and GitHub’s platform, not in macOS, Xcode, or Apple services. Contact Apple Support only if:

• Keychain Access shows unexpected entries created by Claude Code that you cannot delete.
• System Integrity Protection (SIP) alerts indicate the tool attempted to modify protected paths.
• You suspect the binary was replaced by a malicious supply-chain attack distributed through a compromised Homebrew tap or DMG.

For credential rotation, repository rewriting, or GitHub secret scanning configuration, engage the respective service providers or your organization’s security team.

FAQ

Does this affect only public repositories?
No. Private repositories are equally vulnerable to insider access or future visibility changes. Remediate all affected remotes.

Can I recover rotated secrets from Git history after force-push?
GitHub retains orphaned blobs for up to 90 days in its garbage collection window. Use the GitHub REST API to purge cached views, or open a support ticket requesting expedited removal.

Is Claude Code the only AI coding tool with this risk?
Similar tools (Cursor, Windsurf, GitHub Copilot CLI) may write local logs containing file contents. Apply the same gitignore, pre-commit, and secret-scanning discipline universally.

How do I verify my global gitignore is active?
Run git check-ignore -v ~/.claude-code/session.log. It should return the matching rule from ~/.gitignore_global.

What if I cannot force-push because of branch protection rules?
Coordinate with repository admins to temporarily allow force-pushes on affected branches, or use GitHub’s UI to delete and recreate the branch from a clean local copy.