One commandNo installNo API keyNothing leaves your machineMIT

Know what you've already leaked to AI

Your coding agents logged every file they read and every command they ran, in plaintext, forever. spilled is a command-line scanner that finds the credentials sitting in those logs and tells you which ones still work, so you know exactly what to rotate.

$ npx spilled Documentation How it works
actual output, real machine41 sessions / 126.4 MB / 1.2s
How the data actually left Bash ██████████████████ 1344 Edit ████ 333 Read █ 137 Secrets found in transcripts (masked) STILL LIVE DB connection string post****st data-lift-compass not in repo Google API key AIza****3M agent-forge 1 still present in your repo. Rotate these first.
126 MBscanned
1.2sruntime
0deps
4true positives
0false positives
01

What it does

Three steps, about a second, nothing to configure.

1. run it
npx spilled in any terminal. No install, no signup, no API key. It reads only local files and makes no network calls.
2. see what leaked
Every AWS key, GitHub token, Stripe key, database password and private key your agents wrote into their logs. Grouped by project, dated, values masked.
3. rotate what matters
Each finding is checked against your repo. STILL LIVE means it is in your code right now and someone could use it. Everything else is already dead.
Why the logs exist: agents replay past sessions, so every file they read and every command they ran is kept verbatim, in plaintext, indefinitely. Nothing warns you, and nothing cleans it up.
02

Other scanners read the wrong half

They parse Read(file_path=...) calls. Measured across 41 real sessions, that misses most of it.

Problem

Bash outnumbers Read 10 to 1

1,344 Bash calls against 137 Reads. Everything that leaked through cat .env, printenv, git diff or curl carries no file path at all.

A scanner reading tool inputs never sees any of it.

Approach

Scan outputs, not inputs

Both ledgers are extracted: what the agent asked for, and what came back, including the parallel toolUseResult payload most parsers skip.

Content is then attributed back to your files.

03

Every finding carries a verdict

A secret that leaked in July and was rotated in August is history. One still sitting in HEAD is an emergency.

still live
Checked against your working tree. Values are matched in-process, never passed as command arguments, because arguments are visible in the process list.
rotate
Live credentials. Fully fixable. Rotating makes the leaked value worthless.
change logic
Protected by obscurity: token schemes, fraud rules, rate limits, discount logic. Change it and the leaked knowledge dies with it.
cannot fix
Trade secrets, customer data, plans. No code change retrieves them. The honest output is a record and a hardening plan.
04

Precision over recall

The high-entropy sweep ships disabled. That is a decision, not a gap.

named rules
4 findings, 4 real. AWS, GitHub, Stripe, Google, npm, Slack keys, PEM blocks, JWTs, connection strings.
entropy sweep
~130,000 findings, near zero real. Base64-encoded images shatter into thousands of high-entropy fragments. Available behind --paranoid.
A scanner you stop trusting on the first run is worse than no scanner. Default to silence.
05

Also reported

--disk

Transcript bloat

Agent transcript directories grow without bound and have no default cap. Reported cases reach multi-gigabyte sessions and disks filled entirely.

Shows total by agent, biggest sessions, and what is reclaimable.

hijack

Steering attempts

Flags override attempts, role reassignment, prompt extraction, hidden HTML comments, pipe-to-shell and exfiltration instructions found in tool output.

A hijacked run completes successfully, so tests never catch it. The transcript is the only evidence.

06

Scope, stated plainly

covers
Claude Code and Codex CLI, verified against real transcripts. Cursor and opencode via a permissive fallback.
cannot see
Browser pastes. Code dropped into a web chat leaves no local trace, and that is probably the most common way code leaks.
read it as
"Your CLI agents are clean." Nothing more than that.
spilled tells you what leaked and whether it still works. To stop the next one, blind sits between your agent and the API and swaps your names and keys before anything leaves.