MAYBE presidentxerak/cosmowarp — Repository with Claude-authored commits touching wallet code including privateKey handling, potentially a crypto/wallet project that may contain hardcoded secrets.
MAYBE maxiwoj/wifi-usb-hid — ESP8266/ESP32 WiFi HID emulator with Claude-authored commits that contains hardcoded default credentials in the README (WiFi password and web auth credentials), though these appear to be intentional default device credentials rather than leaked secrets.
MAYBE terrysc107-cloud/crcst — Repository with Claude-authored commit implementing Square payment integration - likely contains API keys or secrets for Square checkout, webhooks, and payment processing.
MAYBE haqeeqiazadee-ux/yousell-admin — Claude-authored commits reference cleaning up exposed secrets, including a real Anthropic API key in gap_analyzer/.env.example and a file containing exposed secrets (Final Env Variables Netlify.txt), suggesting real credentials were previously committed.
MAYBE djan1999/Test — A restaurant service board app where Claude authored a commit that explicitly mentions replacing a hardcoded secret 'milka2025' with an environment variable, indicating the secret was previously committed in source code.
MAYBE giannigrespan/trainingpeaks — A Next.js project where Claude (Anthropic AI) authored a commit removing leaked MongoDB Atlas credentials from .mcp.json. The credentials were previously hardcoded and publicly exposed in the repository's git history.
MATCH SAVACAZAN/OmniBus — Repository contains Claude-authored commits that document and hardcode a 12-word BIP-39 mnemonic seed phrase, master seed, private keys, and multiple cryptocurrency wallet addresses directly in source code for a bare-metal crypto trading system.
MAYBE comfybear71/aiglitch — AI social media platform with Solana crypto integration where Claude authored commits adding wallet seed phrase derivation tools and mnemonic-based key management, with references to METADATA_AUTHORITY_MNEMONIC env var but potential for leaked secrets in the wallet tooling code.
MAYBE HumanRupert/x402-usdt0 — A crypto payment protocol demo authored by Claude that uses BIP-39 mnemonic seeds for wallet management. The commit explicitly mentions replacing private keys with mnemonic seeds, but the README shows proper env var patterns rather than hardcoded credentials.
MAYBE ctagg11/Grocery_shopper — Grocery shopping app with Claude-authored commits that includes recipe parsing via Claude API and an Express server - commit message references 'secrets' config files which likely contain API keys.
MATCH diogoasoaresads/portalcury — Claude authored a commit that explicitly mentions removing a hardcoded credential (username/password: diogoasoaresads/06112005) from the codebase, indicating the credential was previously committed in plain text.
MATCH ionSurf/rent-redi-homework — Repository contains a hardcoded OpenWeather API key committed by Claude (Anthropic AI) directly in the README and likely in source code, for a Firebase-backed tenant management platform.
MATCH cool4y/oft — Claude-authored Solana/EVM OFT cross-chain token project where Claude generated and committed Solana keypair files directly into the repository for program deployment, store, mint, and EVM deployer wallets.
MAYBE johnthebakker-ui/Discord — Discord clone where Claude authored commits that include hardcoded TURN server credentials from Metered.ca, embedded directly in the codebase for voice/video to work 'out of the box without requiring env var setup'.
MATCH haqeeqiazadee-ux/Scraper-app — Claude authored a commit explicitly titled 'Add env.keys with all environment variables and API keys' containing centralized platform credentials for an AI scraping platform with multiple third-party service integrations.
MAYBE Fonira/DeepSight-Main — Claude authored a commit that previously contained hardcoded credentials (a gateway token 'MarcellinTyronJean22', VPS IP addresses, Tailscale IPs) in documentation files, which were later redacted in a security fix commit.
MAYBE danyaffa/PWA-App-STORE — Claude authored a commit that explicitly removes a leaked Firebase service account key (pwa-app-store.json) that was previously committed to the repo. The credential file was exposed in git history.
MATCH ZeroBlind2025/cryptoarbitrage — Polymarket arbitrage bot where Claude (Anthropic AI) committed relayer API key and address directly into the codebase instead of using environment variables.
MATCH garyferenczi74-svg/ViaConnect2026 — Claude (Anthropic AI) authored a commit that explicitly replaces placeholder Supabase credentials with real project URL and anon key, hardcoding them directly into source code instead of using environment variables.
MAYBE GrupoLefarma2025/01-lefarma-project — A pharmaceutical management system where Claude Code committed a fix to remove hardcoded production credentials (database connection strings, master password, SMTP password) from appsettings.json, meaning those secrets were previously committed to the repo.
MAYBE andrelealpb/FlacGuard — Claude authored a commit fixing hardcoded database credentials ('flac:flac' and 'flac_guard:flac_guard') in docker-compose.yml and a fallback connection string in pool.js, suggesting real credentials were committed directly into source code.
MAYBE glauberbessa/MiniApps — Repository where Claude authored a commit introducing Supabase client initialization with a 'Service Role Key' - potentially hardcoded credentials in src/lib/supabase.ts.
MAYBE Akshay-singaram/Postgres_Report_Gen — Repository has a Claude-authored commit that explicitly updates DB credentials (host, database, user, password) directly in source code for a WinCC OA PostgreSQL historian connection, despite the README describing proper .env usage.
MATCH martinnhoo/frame-iq-mvp — Claude authored a commit that directly hardcodes Netlify auth token, Netlify site ID, and Supabase credentials in the commit message itself, exposing real deployment secrets.
MATCH Bonaventura-EW/SONAR-POKOJOWY — Claude Assistant committed a GitHub Personal Access Token (PAT) directly into a commit message, exposing the credential `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` in plain text.
MAYBE mhrncal/aplikace-howyouinshit — E-shop analytics platform where Claude AI committed hardcoded login credentials (email: info@shopcode.cz, password: Shopcode2024??) directly in commit messages and setup scripts.