I audited my own Claude Code logs and found real leaked credentials
CrypLedDEV Community
1 views
AI coding agents like Claude Code read your .env files, cat command output, and run shell commands on
your behalf. By design, every one of those actions gets written verbatim into a local session transcript
(~/.claude/projects/**/*.jsonl) so the agent can resume sessions later.
That means anything the agent ever saw — an API key, a database URL, the output of env — is sitting in
plaintext on disk indefinitely. Nobody was auditing those files. So I wrote a small CLI that does.
What it found on my own machine
I ran it against 59 real session files across a handful of unrelated local projects before I did anything
else with it, as a sanity check. It immediately found:
71 findings in one project — mostly database connection strings with embedded credentials and JWTs
that had leaked through tool output into the transcript
2 real AWS access keys in another project's logs
A curl | bash command the agent had actually executed
None of this was hypothetical. It was just sitting there, unaudited, on a normal dev machine.
What it checks for
Secrets: AWS/GCP/GitHub/GitLab/Slack/Stripe/OpenAI/Anthropic/npm/Twilio/Discord keys, PEM private key
blocks, JWTs, database connection strings with embedded credentials, and generic api_key=/password=
assignments.
Risky commands the agent ran: destructive deletes (rm -rf /), remote-code-execution patterns
(curl | bash, base64-obfuscated payloads), fork bombs, reverse shells, chmod -R 777, raw disk writes,
shell-history tampering, firewall disabling, authorized_keys writes, force-pushes to main, DROP TABLE,
and crontab persistence.
Every finding is redacted in the output — it never prints a usable secret, even to your own terminal.
npx agent-audit
100% local, zero dependencies, no network calls, no telemetry, MIT licensed, ~300 lines you can actually
read in five minutes: https://github.com/CrypLed/agent-audit
Why I think this matters
Agentic coding tools are doing real work inside real codebases now — reading secrets, running commands — and
all of that is being logged locally by design, for good reasons (session resume, debugging). That's a new,
mostly-unaudited class of secret sprawl that didn't really exist two years ago. This is a first pass at
making it visible. Codex CLI and Cursor transcript support is next; contributions and false-positive reports
welcome.
Curious if others have run something similar and found real stuff too, or if this was a one-off.
Every number we watched said the run was working. Correct-per-sample probability tripled. The greedy accuracy curve was climbing. By the numbers on our dashboard, this was a textbook RLVR win.
Then we sampled the checkpoint 64 times per problem instead of once. pass@64 had collapsed from 0.83 to 0.
An eight-frame animation does not have a fixed duration. At 8 fps it lasts one second; at 12 fps it lasts two-thirds of a second; at 16 fps it lasts half a second. Before drawing or generating more frames, check whether the problem is missing poses or the time each pose stays on screen.
We maintain
A webcam hand tracker hands you a position, thirty or sixty times a second, as a float
between 0 and 1. A musical scale hands you seven notes per octave. Building a
browser hand-gesture synthesizer is mostly the work of
getting from the first thing to the second thing without it sounding like a fax