Your coding agent saves every conversation to your disk. If you ever pasted an API key into a chat, or asked the agent to read a .env file, that key now sits in plain text in a log file on your laptop, and it went to the model provider the moment you sent the message. Secret scanners point at repositories and CI. Nobody aims one at ~/.claude, because it is not a repository, it is not in CI, and it does not look like a place credentials live. It is.
Why it matters
A key in a transcript has already been sent, and deleting the file does not call it back; only rotating the key does. Nor does a pasted key go out once. It is sent again with every later message in that conversation, and prompt history keeps every prompt you typed and every long paste after the session itself has been cleaned up.
Instruction files are worse. CLAUDE.md and AGENTS.md are read again at the start of every session, so a key in one keeps going to the provider, session after session, until someone edits the file.
So we wrote a tool that looks in those folders. whatileaked scans your Claude Code, Codex, Cursor and opencode history, shows you what is there, and cleans it up. No network calls, no telemetry, no dependencies. It is free and MIT licensed, at github.com/selan-ai/whatileaked.
Two commands
npx whatileaked scan # looks, and changes nothing
npx whatileaked wipe # removes what scan found, once you confirmnpx comes with Node.js 20 or newer and runs the tool once, with nothing to install. A year of history takes about 20 seconds to scan.
Reading a finding
Each heading names the kind of credential after the gitleaks rule that matched, so you can look any of them up. The yellow code is a fingerprint, a short one-way hash. It is never the key or any part of it, which makes the output safe to paste somewhere public. The same key always gives the same fingerprint, so two rows that share one are a key you reused in two projects.
Beside it are the project you were working in and the number of messages that carried the key. Below is the text just before the key, with the key blanked out, which usually tells a test fixture (const TEST_KEY = ***) from a real key (AWS_ACCESS_KEY_ID=***), and the file to open if you want the whole story. A key in CLAUDE.md or AGENTS.md gets its file and line, and the totals count it as still on disk, because the next session will send it again. Well-known example keys, such as AWS's published AKIAIOSFODNN7EXAMPLE, are never reported.
Every scan ends on a line of counts alone, with no project, path, rule or fingerprint in it. That is the line you can share:
whatileaked: 3 credentials sent to a model provider, across 3 transcripts.Rotate first, then wipe
If a finding is real, rotate the key first and issue a new one wherever it came from. The old key has already left your machine.
Then, if you want a clean disk, run wipe. It lists every file it would change and waits for you to type the whole word wipe. Pressing y does nothing, and a script cannot answer, so yes | whatileaked wipe changes no files.
When you do type it, each secret becomes a placeholder such as [REDACTED BY whatileaked: aws-access-token]. Only the lines that held a secret change, and the files stay valid, so your agent can still read its own history.
Where it looks
In Claude Code, it reads the session transcripts (subagents' included), the prompt history, the paste cache and ~/.claude/CLAUDE.md. In Codex, the sessions (archived ones too), the prompt history and ~/.codex/AGENTS.md. In Cursor, the agent transcripts; older Ask-mode chats are not scanned yet. In opencode, the SQLite database, on Node 22.13 or newer. wipe does not rewrite that database, so delete those sessions in opencode, and rotate.
whatileaked reads nothing else: not your repositories, your shell history or your environment.
What it will never do
No type in its code has a field that could hold a secret, so it cannot print one. It makes no network request, not even to check for updates, and writes nothing unless you run wipe and type the word. Installing it adds exactly one package: itself. The scanner is a few hundred lines, and src/scan/scanner.ts is there for you to read.
Why Selan built it
The README says this up front, and so do we: Selan sells a proxy that redacts these keys before they reach the model provider, so we have an obvious interest in you finding a big number.
When a company's owner turns on secret scanning, Selan sweeps each Claude Code and Claude Desktop request with gitleaks' rules and swaps every credential for a marker such as [REDACTED: jwt] before the request goes on to the model, which still answers. The key never reaches the provider, but the copy in your local transcript stays where it is. Finding and removing that copy is what whatileaked is for.