I audited my own Claude Code logs and found real leaked credentials

Claude Code, an AI coding agent, reads .env files, executes shell commands, and writes the interactions into a local session transcript. This process causes sensitive information like API keys and database URLs to be saved in plaintext on disk. The author of this story discovered 71 instances of leaked credentials in one project and two real AWS access keys in another project's logs.

The tool used to find these secrets, called agent-audit, is a small CLI that checks for various types of secrets, including AWS/GCP/GitHub/GitLab/Slack/Stripe/OpenAI/Anthropic/npm/Twilio/Discord keys, PEM private keys, JWTs, database connection strings with embedded credentials, and generic api_key/password assignments. The tool also flags risky commands such as destructive deletes, remote-code-execution patterns, fork bombs, reverse shells, and more.

The findings are redacted in the output and never print usable secrets directly to the terminal. The author emphasizes the importance of this discovery, as agentic coding tools are now doing real work inside codebases and logging sensitive information, which was not a significant concern two years ago. The author has released the agent-audit tool, which is 100% local, has zero dependencies, no network calls, no telemetry, and is MIT licensed.