AP001: Secret in agent history
| Severity | high |
| Runs in | scan |
| One-line fix | Rotate this key with its provider, then delete or redact the history file. |
What it finds
Section titled “What it finds”A key written in the files where an agent keeps what you did: prompt history, saved transcripts,
the paste cache, file edit backups and chat databases. Examples are ~/.claude/history.jsonl,
~/.codex/sessions/ and the chat database of an editor.
Keys are found by pattern: Anthropic, OpenAI, GitHub, AWS, Stripe, Slack and Google formats, plus
a “secret-looking name = random-looking value” rule. Each print shows the key masked, for example
sk-a…(len 105).
Why it matters
Section titled “Why it matters”When you paste a key into a chat, the agent saves it as plain text in your home folder. Any program you run can read that folder. Old history is easy to forget and is rarely cleaned up.
How to fix
Section titled “How to fix”- Rotate the key with its provider. Revoke the old one and make a new one. Treat the old key as public.
- Delete or redact the history file. agentprint never edits history for you.
- Next time, put keys in an environment variable and do not paste them into a chat.
Limits
Section titled “Limits”- Pattern-based only. A key in an odd format can be missed.
- agentprint never uses the key, so it cannot tell you if it still works.
- Credential stores such as
~/.codex/auth.jsonare never read. See AP008.