Guide
How to scan AI coding assistant sessions for leaked secrets
To audit your AI coding sessions for leaked credentials, scan the session logs your assistants write to disk - not your git repository. Claude Code, Codex CLI, Cursor, Gemini CLI, and GitHub Copilot each record chat history locally, and any API key, database URI, or .env value a developer pastes into a prompt is stored there in plaintext, outside every secret scanner pointed at git.
An AI coding session security scanner reads those on-disk logs and surfaces the leaked credentials.
With Skarn it is one command, skarn check, run locally with no upload and no network call
by default.
Last updated 2026-07-03.
Where AI coding assistants store session history
Every mainstream assistant persists chat history to the local disk. That store is the audit target.
- Claude Code
- Writes each session as a JSONL transcript under
~/.claude(plus any directory set inCLAUDE_CONFIG_DIR). Full prompts, tool calls, and outputs are retained. - Cursor and VS Code Copilot Chat
- Store chat history in a local SQLite state database (
state.vscdb) inside the editor's application-support directory. - Codex CLI and Gemini CLI
- Write their own local session logs in the tool's config directory. Same principle: the transcript, including anything pasted in, lives on the machine.
- GitHub Copilot CLI
- Writes JSONL event logs under
~/.copilot(orCOPILOT_HOME), separate from the VS Code Copilot Chat state database above.
How to scan Claude Code history for secrets
Traditional scanners take a repo path. An AI session scanner instead reads the assistant session directories directly. Skarn discovers them automatically for all 6 assistants.
With Skarn: skarn check.
It parses every session, runs 248 detection rules across 200-plus credential types, and correlates
multi-stage prompt-injection-to-exfiltration attack chains. Nothing is uploaded. What the detection
rules cost you in false alarms is measured, not
asserted, and so is what the correlation
costs.
Each finding is shown with the secret masked, attributed to the exact session and message, and scored on a 0-100 risk scale. Output is human-readable, JSON, or SARIF 2.1.0 for your SIEM.
Skarn surfaces exposure; your team rotates the exposed credential and coaches the developer. In CI, gate on severity or risk score so a leak fails the build.
What a session scan catches that git scanners miss
A key pasted into a chat to debug an integration, never written to a file or committed. Invisible to gitleaks and trufflehog, obvious to a session scan. This is the most common shadow-AI leak.
Poisoned content that drives the assistant to read a secret and exfiltrate it through a tool call - correlated across MITRE ATLAS tactic-aligned stages, mapped to the OWASP Top 10 for LLM Applications 2025 and CWE.
A session scan answers that question directly and with evidence, per developer and per session, instead of leaving it a guess. See also the shadow AI DLP guide.
Related: What is an AI session security scanner, how Skarn compares to gitleaks and trufflehog, the standards crosswalk
See what is leaking in your sessions
Book a scoped, consent-first exposure assessment and watch Skarn scan a sample of developer machines in your own environment. Nothing sent to a cloud.