AI coding agents like Claude Code read your .env files, cat command output, and run shell commands...
AI coding agents like Claude Code read your .env files, cat command output, and run shell commands on
your behalf. By design, every one of those actions gets written verbatim into a local session transcript
(~/.claude/projects/**/*.jsonl) so the agent can resume sessions later.
That means anything the agent ever saw — an API key, a database URL, the output of env — is sitting in
plaintext on disk indefinitely. Nobody was auditing those files. So I wrote a small CLI that does.
Claude Code stores 43MB of conversations. Cursor saves passwords in JSONL. Cline gets credentials right but still archives…
A new study reveals how AI coding assistants like Claude Code are quietly hoarding and publishing sensitive API keys to code…
Tired of Claude Code Leaking Your Secrets? I Built Guardrails for It If you use Claude...
Your AI Coding Agent Is Reading Your .env Right Now You opened Claude Code in your project...
Your Claude Code session just spit out a perfect PR description, refactored three services, and...
Last month, a developer cloned a GitHub repo and opened it in Claude Code. Before they even clicked...
