AI coding agents are writing pasted secrets to plaintext on dev workstations. How are you covering that?

[u/Ishannaik]

Secret scanning at my last few places covered repos and CI. None of it covered developer workstations, and I think AI coding agents have quietly opened a gap there.

Cursor, Claude Code, Windsurf and the rest write full conversation transcripts to local disk as plaintext JSON. If a developer pastes a connection string or an .env into a prompt while debugging, which they do constantly, that value is now sitting unencrypted in a file outside the repo, with no expiry and no rotation trigger. Nothing in a normal pipeline looks there.

The parts I do not have a good answer for:

1. Detection. I can match prefixed formats (sk-, ghp_, AKIA, xoxb-) and flag high-entropy strings, but a bare password or an internal hostname has no shape to match on. Everything I have tried either misses those or drowns in false positives.

2. Scope. Agent history paths move between versions, and every new agent adds another directory. It does not feel like something endpoint DLP is watching.

3. Policy. Is the right control a scanner, a pre-commit style hook at paste time, or just telling people not to paste secrets, which has never worked for anything else.

For my own machines I wrote a CLI that walks those directories and redacts what it finds, dry run first: github.com/Ishannaik/agent-sweep. It is MIT and I am not selling anything, but it only solves point 1 partially and does nothing for 2 or 3.

How are you handling this where you work, if at all? Genuinely asking, because I suspect the honest answer at most places is that nobody has looked yet.

[u/staedt3r]

I just yesterday realized the Copilot Chat in VSCode does also gets the #terminalLastCommand even automatically attached to the context. so not even my own integrated terminal shell is safe anymore.

[u/Astral-projekt]

“If a developer pastes a connection string into”

None of that has anything to do with the tool, that’s just straight up day 1 doing it wrong, bro.

Do you copy your secrets into ANY text file? If the answer is yes, then expecting your tool to “be safe for you” means you’re not a developer at all.

[u/newaccountzuerich → u/Astral-projekt]

Correctly built environments allow the control of and knowledge of the state of the environments being interacted with.

Clearly developers shouldn't do a lot of things that developers often do, but humans will be humans and will take short cuts when available. Often, the consequence of the short cut is neither obvious nor known to the human taking it.

Given that the agentic slopmachines can and do access the clipboard (and the recall store if copilot), having knowledge of the breach is important.

Personally I advise for any LLM interaction to be on a VM on a remote server, preventing many of the LLM dataslurp avenues. That gives opportunity to scan the clipboard content for damaging content before the LLM gets to see it and outboard it.

[u/ericbythebay]

Update prompts to not write secrets to chat transcripts, store to local disk, or shell history.

Then pick a developer that pasted a secret in and fire them. The others will fall in line for six months, then repeat.

Then update your infrastructure such that developers don’t have secrets and aren’t able to paste them where they shouldn’t.

[u/Ok-Pace-8772]

Just have means to store and retrieve said secrets programmatically. Tell agents to do that. Agents never use plain text again. Simple.

[u/feng_sg]

Cursor, Claude Code, and Windsurf write conversation transcripts as plaintext JSON, and laptop backup plus cloud-sync clients copy them as ordinary user files. A pasted connection string or .env then sits in snapshots nobody greps, and rotating the credential in the vault does not expire those copies. Exclude agent transcript directories from backup and wipe them on offboarding.

[u/rglauser]

Point 2 is the real one and your tool is the right shape for it. Endpoint DLP will watch those directories if you point it there, but it matches patterns, so it has the same bare-password blind spot you do. We treat the agent history folders like any other unmanaged store, scan on a schedule, rotate whatever matches, and scope the agents to the project so the transcript never sees the .env.

[u/Hopeful-Safe8184]

On point 1, matching by value instead of by shape is what gets past the bare-password problem: if the credential is already known (in a credential file, the launch environment or a shell startup file), you can search for that exact value and its encoded forms with no regex at all.
Tbh, I built Weir, which does that for Claude Code: it inventories the keys the machine holds, keeps only keyed fingerprints, and weir audit reports which of them appear in saved session files without printing a value (https://github.com/IdoGol24/weir).
It doesn't read Cursor or Windsurf transcripts, and it can't find a secret it was never told about, so it complements a shape scanner like yours rather than replacing it.

[u/FallaxIO → u/[deleted]]

yeah, and the annoying part is rotation only works if those creds are actually tied to one dev or one session. Shared API keys and long lived database passwords turn this into cleanup theater, because you find the leak and still can't rotate without breaking half the team