Claude Code is accidentally exposing secrets all over GitHub

TokenTrust is a platform that functions similarly to TrustMRR, but specifically for AI developers. Its purpose is to display the amount of AI usage and allow others to discover developers. Users often share screenshots of their Claude Code usage on social media, with figures ranging from three billion tokens to thousands of dollars' worth of API spend in a month. However, the authenticity of these screenshots is frequently questioned as it is difficult to verify their legitimacy.

The TokenTrust platform aims to provide a more reliable leaderboard where the numbers are verified before being ranked. Claude Code and Codex both maintain a local log of each session, which includes the provider's unique identifiers, model name, timestamp, and token counts for inputs, outputs, cache reads, and cache writes. TokenTrust's command-line interface (CLI) reads these logs and uploads a row for each response, containing only the aforementioned fields. This approach eliminates the need for prompts, responses, file names, and paths.

To prevent fake numbers from being uploaded, TokenTrust implements several checks. The server verifies that the provider IDs match the expected format, ensuring that the same response is not counted twice. If the same response ID is claimed by another account, it is rejected. Additionally, TokenTrust flags responses that are uploaded faster than other agents could have streamed in the same window.

If a large portion of byte-identical token counts is received from a single account, it triggers a flag. TokenTrust also shows uploads that consist primarily of old history but does not rank them. Once users connect their Anthropic organization using a read-only Admin API key, the platform directly integrates the numbers from Anthropic's usage report instead of relying on logs.

Despite these measures, TokenTrust acknowledges that it cannot entirely prevent someone from creating well-formed logs with plausible IDs. However, the fraud rules make it significantly more challenging for potential fabricators. Users can join TokenTrust by signing in with their GitHub or X accounts and running a single command.

After the initial setup, the platform automatically synchronizes the usage data for each Claude Code or Codex session. Currently, TokenTrust features one user at the top of the leaderboard with 2.3 billion tokens and approximately $850 of API-equivalent usage over the last 30 days, setting the benchmark for others to aim for. This information was originally published on Medium.