The short answer
- Yes, it can happen. If a secret is read by a file or printed by a command, it lands in the session — both sent to the model and saved on disk.
- It's stored in plain text under
~/.claude/projects/, and it stays there until you find and remove it. - You can scan for it. Grep for known prefixes, or use a scanner that matches a catalog of secret patterns and redacts the values.
- If one leaked, rotate it. Revoke and reissue the key, then load secrets from a manager so it can't happen again.
How a secret ends up in a session
Claude Code is useful precisely because it can read your code and run commands. That same capability is how credentials leak — usually without anyone pasting a key on purpose:
- You (or Claude)
cata.env, config, or credentials file to debug something. - A command prints a token —
env, a failing request that echoes anAuthorizationheader, a verbose CI log. - You paste a snippet that still has a live key in it.
- A connection string with an inline password scrolls past in output.
In every case the secret becomes part of the conversation. Two consequences follow: it was sent to the model as context, and it was written to the local transcript — a plain-text file that persists long after the session ends.
Where to look
Session transcripts live in
JSONL files under
~/.claude/projects/, one folder per project. They contain
the full text of what you and Claude exchanged — including any file
contents or command output. That's the haystack a leaked secret is
hiding in.
How to scan your history
The quick, partial way: grep
You can search the transcripts for common key shapes yourself:
| Prefix | Typical secret |
|---|---|
sk- | OpenAI / Anthropic-style API keys |
ghp_ / gho_ | GitHub personal / OAuth tokens |
AKIA | AWS access key IDs |
xox[bp]- | Slack tokens |
It works, but it's brittle: it misses formats you don't grep for, catches decoy strings, and gives you no overview of which sessions are affected or what to rotate. It's a spot check, not a scan.
The thorough way: a dedicated scanner
Dinoradar's Leak Radar does this properly, and entirely on your Mac:
- Pattern catalog: it matches a library of known secret formats — API keys, tokens, private keys, connection strings — not just a handful of prefixes.
- Redacted by default: findings show the surrounding context but mask the actual value, so reviewing them doesn't re-expose the secret.
- Per-session findings: each hit is listed with its session so you know exactly where it appeared and what to rotate.
- Status tracking: mark a finding resolved or ignored once you've handled it, and add custom rules for your own key formats.
Nothing is uploaded — the scan runs against the same local JSONL files, so your secrets never leave the machine to be checked for leaks.
What to do if a secret leaked
- Rotate it. Treat the credential as compromised: revoke the old key and issue a new one. It sat in plain text on disk and may have gone to the model — assume exposure.
- Remove it from the environment. Load secrets from a manager or your shell keychain instead of a file that gets
cat-ed, so the same leak can't recur. - Scan the rest of your history. One leak is rarely alone — check every project, not just the session you noticed.
Frequently asked
Can Claude Code leak my API keys or secrets?+
Yes. It reads files and command output, so a secret can be sent to the model as context and written into the local transcript. If you cat a .env, paste a token, or run a command that prints credentials, that value is now recorded in your history on disk.
Where are Claude Code session transcripts stored?+
In plain-text JSONL files under ~/.claude/projects/, one folder per project. They hold the full text of your exchange, including any file contents or command output — which is why a leaked secret persists there until you remove it.
How do I scan Claude Code for leaked secrets?+
You can grep the transcripts for known prefixes (sk-, ghp_, AKIA), but that misses formats and gives no overview. A scanner like Dinoradar's Leak Radar matches a catalog of patterns, redacts the values, and lists findings per session so you know what to rotate.
What should I do if a secret leaked into a session?+
Rotate it — revoke the old key and issue a new one — since it existed in plain text and may have reached the model. Then load secrets from a manager instead of a committed file so it can't leak again, and scan the rest of your history for others.
Find out what's in your session history.
Dinoradar's Leak Radar scans your Claude Code transcripts for secrets — locally, with values redacted. Free forever · Pro $29 once.