I audited my own Claude Code logs and found real leaked credentials

AI coding agents like Claude Code read your .env files, cat command output, and run shell commands on
your behalf. By design, every one of those actions gets written verbatim into a local session transcript
(~/.claude/projects/**/*.jsonl) so the agent can resume sessions later.

That means anything the agent ever saw — an API key, a database URL, the output of env — is sitting in
plaintext on disk indefinitely. Nobody was auditing those files. So I wrote a small CLI that does.

What it found on my own machine

I ran it against 59 real session files across a handful of unrelated local projects before I did anything
else with it, as a sanity check. It immediately found:

• 71 findings in one project — mostly database connection strings with embedded credentials and JWTs that had leaked through tool output into the transcript
• 2 real AWS access keys in another project's logs
• A curl | bash command the agent had actually executed

None of this was hypothetical. It was just sitting there, unaudited, on a normal dev machine.

What it checks for

Secrets: AWS/GCP/GitHub/GitLab/Slack/Stripe/OpenAI/Anthropic/npm/Twilio/Discord keys, PEM private key
blocks, JWTs, database connection strings with embedded credentials, and generic api_key=/password=
assignments.

Risky commands the agent ran: destructive deletes (rm -rf /), remote-code-execution patterns
(curl | bash, base64-obfuscated payloads), fork bombs, reverse shells, chmod -R 777, raw disk writes,
shell-history tampering, firewall disabling, authorized_keys writes, force-pushes to main, DROP TABLE,
and crontab persistence.

Every finding is redacted in the output — it never prints a usable secret, even to your own terminal.

npx agent-audit

100% local, zero dependencies, no network calls, no telemetry, MIT licensed, ~300 lines you can actually
read in five minutes: https://github.com/CrypLed/agent-audit

Why I think this matters

Agentic coding tools are doing real work inside real codebases now — reading secrets, running commands — and
all of that is being logged locally by design, for good reasons (session resume, debugging). That's a new,
mostly-unaudited class of secret sprawl that didn't really exist two years ago. This is a first pass at
making it visible. Codex CLI and Cursor transcript support is next; contributions and false-positive reports
welcome.

Curious if others have run something similar and found real stuff too, or if this was a one-off.