VS Code keeps commands typed with a leading space, even when bash and zsh skip them

A developer found that VS Code's Run Recent Command list kept a token pasted into a remote Debian server, even though the leading space had kept it out of the shell's history file. VS Code's shell integration reads every command as it runs, and anything non-blank goes into a list of the last 100 stored in a SQLite database in the user folder. Terminal scrollback files also save command text and the environment a terminal started with, and clearing the list does not remove the data from disk. The author found the token still recoverable with grep after clearing, and notes that Cursor and Windsurf, which are built on VS Code, appear to store the same list.