Developer audit of Claude Code logs uncovers real AWS keys and risky commands

A developer auditing their own Claude Code session logs discovered that AI coding agents store full transcripts of everything they process, including sensitive credentials, in local JSONL files. Scanning 59 session files across multiple projects revealed 71 findings in one project alone, including database connection strings, JWTs, and two live AWS access keys in another. The logs also recorded risky commands the agent had executed, such as curl-piped-to-bash scripts and destructive shell operations. In response, the developer built and open-sourced a tool called agent-audit, which scans these log files locally for leaked secrets and dangerous command patterns without sending any data externally. The findings highlight a broader security gap as agentic coding tools become more capable and routinely handle sensitive project data.