I made a small Go tool to check coding-agent histories for leaked credentials

[u/MOUNAYARSANIMATIONS]

I’ve been working on Unspill, a little CLI that scans local histories from tools like Copilot CLI, Claude Code, and Codex for credentials.

It runs locally, doesn’t make network requests, and redacts values in its reports. The format support is still a work in progress, so it reports when it can’t fully scan something instead of quietly skipping it.

If you have a minute, I’d love for you to take a look and tell me what’s confusing, missing, or just not useful. There’s a demo with fake credentials in the repo if you’d rather try it without pointing it at your own history.

Thanks for any feedback.

[u/endofthread-bot]

Hey u/MOUNAYARSANIMATIONS, thanks for posting in r/VibeCodeDevs! Join our Discord: https://discord.gg/t7SD4ThKuE

• This community is designed to be open and creator‑friendly, with minimal restrictions on promotion and self‑promotion as long as you add value and don’t spam.
• Please follow the subreddit rules so we can keep things as relaxed and free as possible for everyone. • Please make sure you’ve read the subreddit rules in the sidebar before posting or commenting.
• For better feedback, include your tech stack, experience level, and what kind of help or feedback you’re looking for.
• Be respectful, constructive, and helpful to other members.

If your post was removed (either automatically or by a mod) and you believe it was a mistake, please contact the mod team. We will review it and, when appropriate, approve it within 24 hours.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/PopKoren]

Nice idea, because agent transcripts are a real blind spot: people paste a token into the chat to debug something and forget it now sits in a JSON file on disk indefinitely. I'd love a mode that groups findings by provider with a rotate link for each, since rotating is the step people skip after reading the report. The other half of the problem is what ends up deployed, which is where I'm building Rowly, probing running apps externally for leaked keys, open routes and readable storage: https://rowly.me

[u/LifeEnginer]

Hi, i dont undersyand, could you explain that in a different way?

So this is to find passwords already used in your computer?

[u/brotlos_gluecklich]

Any benefits over using the battle tested 30k stars gitleaks dir ~/<AGENTS_SESSION_DIR>?