Your agent already printed the keys — now what?

In July 2026, @aaronlippold reported in anthropics/claude-code#80153 that a compound Bash call under Claude Code — echo "searching..."; env 2>/dev/null; npm search foo — dumped ~10 live tokens into ~/.claude/projects/**/*.jsonl. The report described permission rules as matching a command prefix, so a middle env slipped through; PostToolUse rewriting for Bash was ignored by the product (#68951). The keys had to be rotated; the transcripts still held copies.

Current Claude Code permissions docs say deny/ask rules split on ; / && / … and fire if any subcommand matches — so Bash(env *) should catch a middle env on current builds. That does not erase secrets already written to disk, and a deny rule still does not cover every spill path (wrappers, bash -c '…', or a tool that prints a known value). spillscan is the contamination survey: one binary discovers Claude Code / Codex / Cursor (and friends) transcript roots, pattern-matches the usual cloud tokens, and can rewrite only the secret substrings while keeping each JSONL line valid JSON — after writing a .bak. A tiny PreToolUse guard denies the env-dump class before the next spill.

It is not a network firewall. It is the meter you wave over the room after someone already opened the vial.

— 2026-10-14 · updated 2026-10-17