Claude Code has been leaking secrets, and nobody noticed
Issue #077 · 4 min read
Claude Code has been leaking secrets, and nobody noticed
A quiet settings bug on GitHub, Anthropic's IPO, and a dashboard that watches your agents
The big story
Claude Code has a settings file. Most people never think about it twice.
That file has been quietly publishing passwords and API keys to public GitHub repos, thousands of times over — that's Ars Technica.
The mechanism is almost funny if you squint. Claude Code asks permission before running certain commands. Users get tired of approving the same command over and over, so they hit "do not ask again." That answer gets written into a settings file, and if a developer commits that file to a repo without thinking, whatever secret sat inside the approved command goes with it.
Nobody hacked anything. Nobody exploited a hole.
A convenience feature and a careless commit did the damage, repeated thousands of times across GitHub.
If your team ships with Claude Code, the fix is not a patch you wait for. It's a repo setting you check today: is .claude/settings.json in your .gitignore? For most teams, the honest answer is nobody's checked.
What shipped
GitHub's secret scanning now reads your CI logs, not just your code. It will flag secrets that show up in GitHub Actions workflow logs, in public preview now, on top of the issues, wikis, discussions, and pull requests it already covers — per the changelog. Paired with the Claude Code story above, this is the same problem from two directions: secrets leak through the places nobody reviews, and the tooling is only now catching up to the second one.
Anthropic's Claude Fable 5.2 is now generally available inside GitHub Copilot, built for multistep coding work across large codebases, per the GitHub changelog. It landed the same week Anthropic launched Fable and Mythos 5.2 more broadly, and the same week Vercel's own usage data says Anthropic is now winning new teams two-to-one over the field. If you're choosing a default model for a coding tool this quarter, that's the one gaining ground.
GitLab published a framework for running an actual decision-grade pilot of agentic AI, rather than a demo that just proves the agent can produce an impressive-looking output — per the GitLab blog. Worth the read if your team is about to greenlight an agent pilot and nobody has written down what "it worked" actually means.
What I'd actually do this week
- Check your
.gitignorefor.claude/settings.jsontoday. This takes two minutes and costs nothing. Thousands of other teams didn't do it first. - If you're evaluating coding agents for next quarter, put Claude Fable 5.2 on the list. It's now sitting inside GitHub Copilot and winning new teams at twice the rate of its nearest rival, according to Vercel's own gateway data.
- Before you approve an agentic AI pilot, write down what "pass" looks like. GitLab's framework is a useful starting checklist if you don't already have one.
Reply and tell me what broke in your repo this week — I read every one.