If you're new to coding agents: they keep a diary, and your API keys are in it

Something nobody tells you when you start using Claude Code / Cursor / Codex / any of these: every session gets saved to your disk. The whole conversation. Forever. Which is fine — until you remember that time you pasted an API key straight into the chat "just to test something." Or the agent printed your env vars while debugging. Or a stack trace with your database URL in it. All of that is sitting in plaintext files in folders like ~/.claude right now, and it happily tags along into your Time Machine backups, your Dropbox sync, that screen share last week. Not a scary-hacker thing. It's the same as your shell history — boring housekeeping, except for a history most people don't even know exists. Go look at the folder, honestly, it's eye-opening. A friend of mine, Ishan — solid dev, better known in the Cardano world — built a tool for exactly this cleanup, just trying to give people something they can actually use. It checks the local history of ~29 different agents for a couple hundred secret patterns, runs fully offline (nothing leaves your machine), and just scans by default — it only redacts if you tell it to, and it makes backups you can undo from. Genuinely beginner-friendly. Two things worth doing with it: don't trust me or him — point your own agent at the repo and ask it for a safety review before you run anything (good habit for every tool you find on the internet, this one included). And if it misses a pattern or you want your runtime covered, open a PR — he's responsive. Link in the comments. Not my project, just vouching for the guy and the idea. What do you all do about old sessions — clean them, ignore them, or is this the first you're hearing that they exist?