DEV Community

CrypLed
CrypLed

Posted on

I audited my own Claude Code logs and found real leaked credentials

#ai

AI coding agents like Claude Code read your .env files, cat command output, and run shell commands on
your behalf. By design, every one of those actions gets written verbatim into a local session transcript
(~/.claude/projects/**/*.jsonl) so the agent can resume sessions later.

That means anything the agent ever saw — an API key, a database URL, the output of env — is sitting in
plaintext on disk indefinitely. Nobody was auditing those files. So I wrote a small CLI that does.

What it found on my own machine

I ran it against 59 real session files across a handful of unrelated local projects before I did anything
else with it, as a sanity check. It immediately found:

  • 71 findings in one project — mostly database connection strings with embedded credentials and JWTs that had leaked through tool output into the transcript
  • 2 real AWS access keys in another project's logs
  • A curl | bash command the agent had actually executed

None of this was hypothetical. It was just sitting there, unaudited, on a normal dev machine.

What it checks for

Secrets: AWS/GCP/GitHub/GitLab/Slack/Stripe/OpenAI/Anthropic/npm/Twilio/Discord keys, PEM private key
blocks, JWTs, database connection strings with embedded credentials, and generic api_key=/password=
assignments.

Risky commands the agent ran: destructive deletes (rm -rf /), remote-code-execution patterns
(curl | bash, base64-obfuscated payloads), fork bombs, reverse shells, chmod -R 777, raw disk writes,
shell-history tampering, firewall disabling, authorized_keys writes, force-pushes to main, DROP TABLE,
and crontab persistence.

Every finding is redacted in the output — it never prints a usable secret, even to your own terminal.

npx github:CrypLed/agent-audit
Enter fullscreen mode Exit fullscreen mode

100% local, zero dependencies, no network calls, no telemetry, MIT licensed, ~300 lines you can actually
read in five minutes: https://github.com/CrypLed/agent-audit

Why I think this matters

Agentic coding tools are doing real work inside real codebases now — reading secrets, running commands — and
all of that is being logged locally by design, for good reasons (session resume, debugging). That's a new,
mostly-unaudited class of secret sprawl that didn't really exist two years ago. This is a first pass at
making it visible. Codex CLI and Cursor transcript support is next; contributions and false-positive reports
welcome.

Curious if others have run something similar and found real stuff too, or if this was a one-off.

Top comments (0)