spillscan

Your agent is leaking.

Every env, printenv and cat .env an agent runs lands in plaintext session logs on your disk. spillscan finds the keys that already spilled and soaks them up in place.

~/.claude/projects/-Users-dev-shop/7f3c9a.jsonl 5 bleeding · 0 soaked

    Wipe the pad over a stain.Tap a stain, or just scroll. Or Tab + Enter.

    All secrets shown are fake fixtures.

    Grab the kit 
    go install github.com/Blackman99/spillscan/cmd/spillscan@latest
    then spillscan scan

    Spill response, in four moves.

    1. 1

      Contain

      Install the guard so the next echo x; env; npm test is denied before it runs. Current Claude Code deny rules already split compound commands; the guard still covers wrappers and dump shapes a single Bash(env *) can miss — and spillscan cleans secrets already in transcripts.

      # .claude/settings.json
{ "hooks": { "PreToolUse": [{ "matcher": "Bash",
  "hooks": [{ "type": "command", "command": "spillscan guard" }] }] } }
    2. 2

      Survey

      Walk every transcript under ~/.claude/projects, ~/.codex/sessions and Cursor. Patterns plus entropy, so unknown tokens show up too.

      $ spillscan scan
RULE        PREVIEW    FP            AGENT        FILE:LINE
aws-akia    AKIA…MPLE  8cc03843ecd0  claude-code  ~/.claude/projects/…/x.jsonl:128
github-pat  ghp_…ABCD  cbac6b3a48c4  claude-code  ~/.claude/projects/…/x.jsonl:128
openai-sk   sk-p…demo  8a11fd79fd89  codex        ~/.codex/sessions/…/y.jsonl:44
CONTAMINATED — 3 distinct secrets in 2 files.

      A fixture key from the docs? Copy its FP into your allowlist and the next survey leaves it out. The header still says allowlisted=1, so nothing goes quiet without a trace.

    3. 3

      Rotate

      Revoke the keys at the provider first. Scrubbing a log does not un-leak a credential that already left your machine.

    4. 4

      Absorb

      Preview with spillscan redact, then apply. JSONL stays valid, each file keeps a .bak.

      $ spillscan redact --write
REDACT (write)  files=2 replaced=3
SCRUBBED — 3 secrets replaced with [REDACTED:<rule>]

      Scrubbed the wrong thing? spillscan undo puts the .bak originals back and keeps every line the agent wrote since.

    What's in the kit

    No Go toolchain?
    V=0.2.0; OS=$(uname -s | tr A-Z a-z); ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
curl -fsSL "https://github.com/Blackman99/spillscan/releases/download/v$V/spillscan_${V}_${OS}_${ARCH}.tar.gz" | tar xz spillscan
sudo mv spillscan /usr/local/bin/ && spillscan version
    Reads
    Claude Code, Codex and Cursor transcripts. Local and offline. Nothing is uploaded.
    Known fakes
    Tag them once and spillscan leaves them alone in scan, redact and the MCP report. A fingerprint is enough, so the value itself never has to be written down. 
    # ~/.config/spillscan/allow.txt
fp:8cc03843ecd0                         # AWS docs example key
rule:jwt path:~/.claude/projects/*docs*/**
    Not a firewall
    gitleaks scans directories but doesn't understand transcripts; Stroq matches values you already know and won't touch past records. spillscan is the cleanup for leaks that already happened. Origin: claude-code#80153.
    More
    Docs · Install guide · Releases · Why transcripts spill · 中文 · Allowlisting known fakes · 中文