Your coding agent saved that command exactly as you typed it, password and all. Tens of thousands of those secrets are now public on GitHub, and since November 10 a stealer has been collecting developer credentials at scale. See where you stand in about a minute.
Pick the folder your projects live in. Files are read inside this tab and are never uploaded.
Reads agent files only (.claude, .mcp.json, .cursor, CLAUDE.md and the like), plus ignore files and Dockerfiles. Skips node_modules and .git. Git history and your home folder need the command-line version.
November 10
Stolen credentials for 4,837 GitHub accounts were used to open probe pull requests in 61,764 repositories. In at least 1,806 of them the stealer ran. It takes Actions secrets, cloud credentials, and tokens for AI providers and coding tools. About 92% of the probe pull requests were still open when Aikido published, which means most owners had not noticed.
Source: Aikido Security, BleepingComputer
November 5 to 9
GitGuardian counted 31,088 distinct secrets in Claude Code’s settings.local.json across 23,276 public repositories, 5,343 still valid when found. About half sit inside curl commands. Most have no recognizable key format, which is why Apiiro measured gitleaks and TruffleHog together missing about one leaking file in five.
Source: GitGuardian, Cloud Security Alliance
A password after PGPASSWORD= looks like any other word, so scanners built around key prefixes pass over it. This one reads agent rules the way a shell would: environment prefixes, -p and --password flags, sshpass, curl -u, Authorization and API-key headers, and user:password@host URLs. It also knows 30 provider key formats.
.claude/settings.local.json and settings.json, .mcp.json and the Cursor, VS Code, Windsurf, Gemini, Codex and Kiro equivalents, login files such as .claude/.credentials.json and .codex/auth.json, and the notes agents keep: CLAUDE.md, AGENTS.md, memory files, saved transcripts.
A .gitignore that relies on one machine’s git excludes. A Dockerfile with COPY . . and no .dockerignore, which ships files git ignores. An npm package with no files list. Settings that switch off prompts or approve every MCP server in a repo.
Probe pull requests titled “docs: dependency audit notes”, the wfx-docs branch, payload file names, stealer markers in workflows and install hooks, and the two package versions named in the advisories. The command-line version also checks local git for the campaign’s commit messages and branch names.
GitHub is the part anyone can see. The same files sit in your private repos, in git history, and on your laptop, where a stealer reads them without needing GitHub at all.
| What you get | Free | Pro$19 once | Team$49 once |
|---|---|---|---|
| Public GitHub check, full detail | Yes | Yes | Yes |
| Folder sweep in the browser | Top 3 findings in full | Every finding, with location and fix | Every finding, with location and fix |
| Fix kit: what to rotate first, ignore files, history purge commands, a pre-commit hook | No | Yes | Yes |
| Command line: git history | No | Yes | Yes |
| Command line: home folder, logins, session transcripts | No | Yes | Yes |
| Reports to download (Markdown, JSON) | No | Yes | Yes |
| Developers covered | Anyone | 1 | Up to 10 |
| Run the free check | Buy Pro for $19 | Buy Team for $49 |
One payment through Stripe, no subscription. Your license key appears as soon as checkout completes and works offline. Includes every version 1 update. If it finds nothing useful for you, reply to your receipt within 14 days for a refund.
One file, no dependencies, no network requests. Read it before you run it.
# download, read, then sweep your projects (free)
curl -fsSLO https://dontaskagain.dev/daa.mjs
node daa.mjs ~/code --wfx
# Pro: git history, home folder, reports
node daa.mjs ~/code --history --home --report --license DAA1.…No. The GitHub check runs in your browser and talks to GitHub’s public API directly. The folder sweep reads files inside this tab. This site has no server that receives scans. The only thing it ever sends us is a checkout ID when you activate a purchase. Open your browser’s network panel and watch.
It means none of these checks matched what is public right now. It is not proof that nothing was taken. The wfx-loot payload usually deletes its own workflow run, and GitHub may already have removed attacker pull requests. If your account pushed anything you do not recognize since November 10, rotate first and investigate after.
GitHub allows 60 anonymous requests an hour from one network. The check spends them on your most recently pushed repositories, then probes the rest at the paths where these files usually live. For full coverage, clone and use the folder sweep, or run it again after the limit resets.
It reads only what GitHub already shows everyone, and every secret is masked before it reaches the page. Check accounts you are responsible for. If you find a leak in someone else’s repository, tell them privately.
Not only. Claude Code keeps its local settings file out of git on the machine that creates it, and any tool that remembers approved commands has the same edge. The problem is a literal credential inside a command. Use a variable such as $DB_PASSWORD and the saved rule stores a name, not a value. This page finds the ones already saved.
Null0x, an engineer at Hyperion Strategies who works on the security of AI-written code. It is an independent project, not affiliated with or endorsed by Anthropic, GitHub, Aikido, GitGuardian or Apiiro.
Checks dated November 12, 2026. Indicators change as research continues.