Audit finds Claude Code session transcripts persist API keys and risky commands in plaintext

Claude Code transcripts store secrets by design

According to a post on dev.to, a developer who audited their own Claude Code session logs found real credentials exposed in plaintext on their own machine. The root cause is architectural rather than a bug: agents such as Claude Code read .env files, capture shell command output, and run commands on the user's behalf. To allow sessions to be resumed later, Claude Code writes all of that activity verbatim into local JSONL transcripts under ~/.claude/projects/. The practical result is that anything the agent ever saw — an API key, a database URL, the output of env — is written to disk in cleartext and kept there with no expiry, in files few developers ever open.

What the audit found

Before publishing anything, the author ran their scanner as a sanity check across 59 session files from several unrelated local projects. It immediately surfaced 71 findings in one project — mostly database connection strings with embedded credentials and JWTs that had reached the transcript through tool output — plus two real AWS access keys in another project's logs, and a curl | bash command the agent had actually executed. The author emphasises these were not hypothetical results; the material had accumulated unnoticed on an ordinary development machine.

What the scanner checks

To make the problem visible, the author built agent-audit, a small CLI that runs via npx agent-audit. It looks for two categories of issues in transcripts.

The first is secrets: keys for AWS, GCP, GitHub, GitLab, Slack, Stripe, OpenAI, Anthropic, npm, Twilio and Discord; PEM private key blocks; JWTs; database connection strings with embedded credentials; and generic api_key= or password= assignments.

The second is risky commands the agent actually ran: destructive deletes such as rm -rf /, remote-code-execution patterns like curl | bash and base64-obfuscated payloads, fork bombs, reverse shells, chmod -R 777, raw disk writes, shell-history tampering, firewall disabling, writes to authorized_keys, force-pushes to main, DROP TABLE statements, and crontab-based persistence.

Every finding is redacted before display, so the tool never prints a usable secret, even to the operator's own terminal. The project is MIT-licensed, roughly 300 lines of code, has no dependencies, makes no network calls, and collects no telemetry.

Why it matters

As the author frames it, agentic coding has created a largely unaudited category of secret sprawl that barely existed two years ago. Agents now do real work inside real codebases — reading secrets, running commands — and by design they log all of it locally so sessions can be resumed and debugged. Conventional secret scanning focuses on repositories and CI pipelines; agent transcripts on developer machines sit outside that perimeter.

For developers using Claude Code or similar agents, the practical takeaways are to treat transcript files as sensitive artefacts: restrict file permissions, rotate any credentials that may have flowed through tool output, and periodically audit the logs. The author notes that support for Codex CLI and Cursor transcripts is planned next, which points to the wider issue — any agent that logs its context for session resume has the same exposure.

There are caveats worth keeping in mind. The findings come from a single self-reported audit, detection is pattern-based and can produce false positives, and the post is partly a launch announcement for the tool itself. Even so, the core observation is easy to verify independently: the transcripts are on your disk, and they may contain more than you expect.