Your AI agent's history is quietly storing the API keys you pasted into it

Something I keep running into building with agents: the local history and log files these tools keep are a quiet secret-leak surface. Every time you paste an API key, a token, or a chunk of a .env into a prompt, it can persist in those files on disk long after the conversation is gone. Most people never clean them. I built a small open-source CLI that scans those agent history and log files (Claude Code, Cursor, and others), finds API keys, tokens, and credentials, and redacts them in place. The history stays readable, the secret is gone, and it runs entirely locally so nothing is uploaded. Honest framing: it is local hygiene, not a substitute for rotating a key you actually sent to a hosted model. If you leaked a live key to a cloud agent, rotate it. This closes the on-disk residue. Repo link in the first comment (subreddit rule). Curious how others here handle secret residue in agent histories.