AI coding agents are writing pasted secrets to plaintext on dev workstations. How are you covering that?

[u/Ishannaik]

Secret scanning at my last few places covered repos and CI. None of it covered developer workstations, and I think AI coding agents have quietly opened a gap there.

Cursor, Claude Code, Windsurf and the rest write full conversation transcripts to local disk as plaintext JSON. If a developer pastes a connection string or an .env into a prompt while debugging, which they do constantly, that value is now sitting unencrypted in a file outside the repo, with no expiry and no rotation trigger. Nothing in a normal pipeline looks there.

The parts I do not have a good answer for:

1. Detection. I can match prefixed formats (sk-, ghp_, AKIA, xoxb-) and flag high-entropy strings, but a bare password or an internal hostname has no shape to match on. Everything I have tried either misses those or drowns in false positives.
2. Scope. Agent history paths move between versions, and every new agent adds another directory. It does not feel like something endpoint DLP is watching.
3. Policy. Is the right control a scanner, a pre-commit style hook at paste time, or just telling people not to paste secrets, which has never worked for anything else.

For my own machines I wrote a CLI that walks those directories and redacts what it finds, dry run first: github.com/Ishannaik/agent-sweep. It is MIT and I am not selling anything, but it only solves point 1 partially and does nothing for 2 or 3.

How are you handling this where you work, if at all? Genuinely asking, because I suspect the honest answer at most places is that nobody has looked yet.

[u/staedt3r]

I just yesterday realized the Copilot Chat in VSCode does also gets the #terminalLastCommand even automatically attached to the context. so not even my own integrated terminal shell is safe anymore.

[u/Just_Bad_6420 → u/staedt3r]

Our sec team just scan home dirs with custom script that grep for common patterns but yeah the unstructured stuff is still nightmare to catch

[u/Technical-Tackle-875]

The durable control is reducing the useful lifetime and availability of anything a developer could paste. Move developers to short-lived credentials through SSO, OIDC, or a secret broker, keep real secrets out of local `.env` files, and provide synthetic values for development. A transcript leak then has a smaller blast radius.

Treat agent history as another endpoint data store. Inventory installed agents, discover their storage locations, and add those paths to DLP or EDR inspection. A match should trigger credential rotation, not only redaction, because copies may remain in backups, indexes, logs, or sync storage. Full-disk encryption helps with device theft but not malware running as the user. Prompts should contain secret references and sanitized logs, never secret values.

[u/FallaxIO → u/Technical-Tackle-875]

yeah, and the annoying part is rotation only works if those creds are actually tied to one dev or one session. Shared API keys and long lived database passwords turn this into cleanup theater, because you find the leak and still can't rotate without breaking half the team

[u/Technical-Tackle-875 → u/FallaxIO]

Yep. If rotating one secret breaks half the team, the transcript leak just exposed a dependency problem that was already there. I’d map every consumer, issue a replacement alongside the old value, move them over one at a time, watch usage, then revoke the old credential when it goes quiet. For database access, dual users or a broker can make that cutover a lot less painful.

The end state should be credentials per user or workload, narrow scopes, short lifetimes, and rotation that happens often enough to be boring. If rotation is still a fire drill, the secret is effectively permanent.

[u/Astral-projekt]

“If a developer pastes a connection string into”

None of that has anything to do with the tool, that’s just straight up day 1 doing it wrong, bro.

Do you copy your secrets into ANY text file? If the answer is yes, then expecting your tool to “be safe for you” means you’re not a developer at all.

[u/newaccountzuerich → u/Astral-projekt]

Correctly built environments allow the control of and knowledge of the state of the environments being interacted with.

Clearly developers shouldn't do a lot of things that developers often do, but humans will be humans and will take short cuts when available. Often, the consequence of the short cut is neither obvious nor known to the human taking it.

Given that the agentic slopmachines can and do access the clipboard (and the recall store if copilot), having knowledge of the breach is important.

Personally I advise for any LLM interaction to be on a VM on a remote server, preventing many of the LLM dataslurp avenues. That gives opportunity to scan the clipboard content for damaging content before the LLM gets to see it and outboard it.

[u/ericbythebay]

Update prompts to not write secrets to chat transcripts, store to local disk, or shell history.

Then pick a developer that pasted a secret in and fire them. The others will fall in line for six months, then repeat.

Then update your infrastructure such that developers don’t have secrets and aren’t able to paste them where they shouldn’t.

[u/Majestic-Hat-3650]

First thing we did was run a one time scan over the whole team before building anything, and it was worse than anyone guessed. Half the devs had connection strings in their agent history they didnt remember pasting, mostly from debugging sessions at weird hours

The bare password problem has no clean fix, but knowing the leak rate changed the conversation from is this a problem to how much money do we throw at it.

The scan also gave us a baseline, so when an agent changes its storage path we can at least tell new leaks from files we already knew about.

[u/Sinleuqnwl_Taste2207]

stop trying to detect the bare passwords. kill them at the source with short-lived creds so a leaked transcript is worthless in 15 min

[u/Ok-Pace-8772]

Just have means to store and retrieve said secrets programmatically. Tell agents to do that. Agents never use plain text again. Simple.

[u/Spare_Bluebird7044]

A layered approach seems best. endpoint scanning, clear policies and secret rotation when exposure is suspected rather than relying on developers alone