Your AI coding transcripts are a secret store: where Claude Code, Codex, Cursor, Copilot and Antigravity keep them

Originally published on ReclaimLLM: https://reclaimllm.com/blogs/ai-coding-transcripts-secret-store

Every agent session leaves JSONL on the laptop—and pasted keys go with it. Per-tool paths, a safe scan recipe, and the fix order: rotate, purge, prevent.

Your AI coding transcripts are a secret store: where they live and how to clean them up

Executive summary

• The plaintext transcript left on disk after a session—not the model provider—is usually the real leak surface.
• Per-tool path table for Claude Code, Codex, Cursor, Copilot, and Antigravity, plus a safe scan recipe and rotate-then-purge fix order.
• Claude Code: ~/.claude/projects/. Codex sessions: ~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl (separate history.jsonl is a prompt index, not synced by rclm-sync).
• Supporting context: GitGuardian reported a 3.2% secret-leak rate in Claude Code-assisted public commits vs a 1.5% baseline (correlation, not causation).

AI coding agents save each session as a local transcript—usually JSONL under your home directory. Anything pasted, printed, or read in that session, including API keys from .env files or CI logs, is written there in plain text. The leak surface is often the laptop copy, not the model provider’s dashboard. Treat transcripts like a secrets file: scan, rotate, purge, and redact before new content is written.

GitGuardian’s 2026 analysis of public GitHub commits reported a 3.2% secret-leak rate in commits associated with Claude Code assistance versus a 1.5% baseline across all public commits (AI coding agents and credential security). That statistic does not prove Claude Code caused the leaks—it shows assisted workflows correlate with more secret exposure.

For prevention at the source, see prevent API keys and .env from AI coding tools. This post is the after-the-fact map.

Where each agent keeps transcripts

Live hooks receive transcript paths from each tool at runtime. The table below matches ReclaimLLM’s rclm-sync historical import paths—what we glob in production when backfilling past sessions—and aligns with vendor docs.

Tool	Path on disk	Notes
Claude Code	~/.claude/projects/**/*.jsonl	Anthropic documents local caching under the Claude directory; default local retention is adjustable via cleanupPeriodDays in data usage docs
Codex CLI	~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl	Full session transcripts. Separate file: ~/.codex/history.jsonl is a prompt-index style log—not imported by ReclaimLLM sync
Cursor	~/.cursor/projects/[project]/agent-transcripts/[session-id]/[session-id].jsonl	Cursor passes the path to hooks at session end (hooks docs)
GitHub Copilot	~/.copilot/session-state/**/events.jsonl	Agent / CLI session events
Antigravity	~/.gemini/antigravity-cli/brain/<id>/.system_generated/logs/transcript.jsonl	Concrete path used by ReclaimLLM sync (Antigravity hooks)

If you use only one tool today, still read the full table—engineers often run two agents on the same laptop.

Why the path table matters for incident response

When someone says “I pasted a key into Claude,” your first question should be where a copy still exists. Provider dashboards may not show the full tool output chain. Local JSONL does—including intermediate tool output. Cursor capture uses transcripts as the source of truth for the same reason: the file on disk is the complete artifact.

Historical import via rclm-sync walks the directories above so past sessions appear in the console even before hooks were installed. Org capture can duplicate sensitive lines you already rotated—set retention and legal hold accordingly (settings and compliance docs).

Copies you forget

Transcripts are not only in the obvious folder:

• Backups: Time Machine, corporate endpoint backup, and laptop imaging copy home-directory JSONL verbatim.
• Sync: iCloud Desktop, OneDrive, or Dropbox syncing ~ or dotfile repos.
• Dotfile repos: committing .claude or .cursor history by mistake.
• Shared session links inside chat products.

Anthropic upload flows (do not conflate them)

Two different retention stories apply to Claude Code:

1. /feedback, /bug, and /share reports are retained for five years per data usage docs. Those docs do not promise secret redaction on that standard upload path—do not assume it.
2. Post-session “Can Anthropic look at your transcript?” survey: if the user selects Yes, known API key and token patterns are redacted before upload; source code, file contents, and other conversation content are uploaded as-is. Shared transcripts in that flow are retained up to six months.
3. When /feedback falls back to a local archive (third-party providers without Anthropic credentials), known API key/token patterns are redacted before archiving.

ReclaimLLM does not delete or rewrite provider-owned transcript files on disk. Capture and redaction apply to what ReclaimLLM captures.

How to scan your own transcripts (safe recipe)

Use a secrets scanner on the paths above—never paste real findings into Slack or tickets.

1. Create a fake AWS-shaped key in a throwaway file: AKIAFAKEFAKEFAKEFAKE (example only).
2. Run a scanner over one agent directory:

gitleaks dir ~/.claude/projects --no-git

Or:

trufflehog filesystem ~/.codex/sessions

1. Confirm the fake key is reported. Then scan the rest.

Rotate any real credential you find; do not treat “scanner clean” as proof nothing ever leaked to a provider.

Scan each agent directory your team uses—mixed fleets are common after a Cursor pilot and a Claude Code rollout. Exclude node_modules and build output if the scanner supports ignore rules to cut noise.

For teams without a dedicated forensics bench, run scans from a clean admin machine with read-only mount of the laptop disk image during offboarding—same paths, same commands.

You found one: rotate, then purge

Order matters:

1. Rotate the credential at the issuer (cloud console, SaaS admin, database user). Assume the value exists in backups and sync copies.
2. Purge local transcripts for the affected sessions (delete JSONL files or shorten retention via vendor settings).
3. Document the incident class without embedding secret material in the ticket.

For detection going forward, configure AD-004 sensitive-file alerts.

Preventing new secrets in transcripts

Control	What it does	Limit
Deny rules	Block Read(./.env) and similar	Shell paths may bypass Read
.claudeignore / env deny patterns	Reduce accidental reads	Not a crypto boundary
Hook redaction	Local redaction replaces configured strings and excludes folders	String replacement, not semantic DLP

When ReclaimLLM’s hook runs, recognized .env reads are sanitized or denied. Hook crash or timeout can still fail open unless you configure vendor hook failure modes yourself—ReclaimLLM’s installer does not set Claude onFailure: "block" or Cursor failClosed.

ReclaimLLM captures from provider transcripts; the provider’s own file on disk may still hold unredacted text after redaction in flight (capture model caveat). ReclaimLLM-owned local artifacts use owner-only permissions.

Pair prevention with governance: a one-page policy should name transcript retention next to approved tools—see AI coding agent governance for small teams. Coverage alerts tell you when hooks disappear; they do not purge old JSONL—purge is still a local operation.

Retention and deletion on the ReclaimLLM side

If you use ReclaimLLM capture:

• Encrypted session storage for Paid/Enterprise with an org recovery key—not zero-knowledge (Jun 2026 announcement).
• Retention policy and legal hold in admin settings; deferred account deletion after 30 days when configured.
• US or EU storage region only—no self-hosted deployment.
• SOC 2 Type II is targeted for early 2027; not certified today.

Session sharing uses opaque tokens—treat shared links like any other confidential URL.

Email alerts for secret patterns (AD-004) fire on exfiltration detectors—they do not replace transcript purge. Use alerts to find the session id, then locate the on-disk JSONL path from the table above for local cleanup.

Offboarding checklist

Copy for IT when a developer leaves or a laptop is reissued:

• [ ] Rotate org secrets the person could see in the last 90 days.
• [ ] Scan ~/.claude/projects, ~/.codex/sessions, ~/.cursor/projects, ~/.copilot/session-state, Antigravity brain logs for live patterns.
• [ ] Remove MCP OAuth token files (e.g. Antigravity ~/.gemini/antigravity/mcp_oauth_tokens.json) if present.
• [ ] Wipe or destroy disk; verify backup scope if the home folder was synced.
• [ ] Revoke ReclaimLLM / gateway keys in access review workflow.

Next step

Redact secrets before they hit the transcript—start free. For the DLP product story, see AI coding assistant DLP. Deep dive on what is AI DLP.

FAQ

Where does Claude Code store conversation history?

Under ~/.claude/projects/ as JSONL session files. Adjust local cache duration via Claude Code settings documented in Anthropic data usage docs.

Where are Codex CLI session logs stored?

Full sessions: ~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl. The separate ~/.codex/history.jsonl file is a prompt index—not the full transcript and not synced by ReclaimLLM’s historical import.

Do AI coding transcripts contain secrets?

Yes, if a developer pasted a key, the agent printed tool output with credentials, or a file read embedded secrets in the transcript.

Should I delete AI agent transcripts?

After rotating exposed credentials, yes—delete or shorten retention to reduce backup and forensic risk.

Does redaction remove secrets already on disk?

No. Hook redaction affects new tool calls and what ReclaimLLM captures going forward. Purge provider-owned files separately.

---

Originally published at https://reclaimllm.com/blogs/ai-coding-transcripts-secret-store