AI coding agents like Claude Code read your .env files, cat command output, and run shell commands on your behalf. By design, every one of those actions gets written verbatim into a local session transcript (~/.claude/projects/**/*.jsonl) so the agent can resume sessions later. That means anything the agent ever saw — an API key, a database URL, the output of env — is sitting in plaintext on disk indefinitely. Nobody was auditing those files. So I wrote a small CLI that does. What it found on my own machine I ran it against 59 real session files across a handful of unrelated local projects before I did anything else with it, as a sanity check. It immediately found: 71 findings in one project — mostly database connection strings with embedded credentials and JWTs that had leaked through tool output into the transcript 2 real AWS access keys in another project's logs A curl | bash command the agent had actually executed None of this was hypothetical. It was just sitting there, unaudited, on a normal dev machine. What it checks for Secrets: AWS/GCP/GitHub/GitLab/Slack/Stripe/OpenAI/Anthropic/npm/Twilio/Discord keys, PEM private key blocks, JWTs, database connection strings with embedded credentials, and generic api_key=/password= assignments. Risky commands the agent ran: destructive deletes (rm -rf /), remote-code-execution patterns (curl | bash, base64-obfuscated payloads), fork bombs, reverse shells, chmod -R 777, raw disk writes, shell-history tampering, firewall disabling, authorized_keys writes, force-pushes to main, DROP TABLE, and crontab persistence. Every finding is redacted in the output — it never prints a usable secret, even to your own terminal. npx agent-audit 100% local, zero dependencies, no network calls, no telemetry, MIT licensed, ~300 lines you can actually read in five minutes: https://github.com/CrypLed/agent-audit Why I think this matters Agentic coding tools are doing real work inside real codebases now — reading secrets, running commands — and all of that is being logged locally by design, for good reasons (session resume, debugging). That's a new, mostly-unaudited class of secret sprawl that didn't really exist two years ago. This is a first pass at making it visible. Codex CLI and Cursor transcript support is next; contributions and false-positive reports welcome. Curious if others have run something similar and found real stuff too, or if this was a one-off.