Developer
You didn't make a mistake. The surface was invisible.
AI coding assistants are indispensable. They also log everything - every file they read, every prompt you sent, every credential that ended up in context. Not because the tools are malicious; because that is how they work. Skarn makes that surface visible, locally, without sending anything anywhere - and it is the fastest way to search across every past session you have.
What is actually happening
Claude Code, Cursor, GitHub Copilot, Gemini CLI, and Codex write every prompt, every file context, every tool call, and every response to plaintext log files. It enables history and session continuity - and it means every credential you pasted in is sitting on disk, unencrypted.
Your secret scanners and CI secret scanning look at git commits and configured paths. They do not look at AI session logs. A key you pasted into Cursor to debug an API call and never committed is completely invisible to them - valid, unrotated, and unknown.
Malicious content in files your assistant reads can instruct it to read secrets and exfiltrate them via tool calls - piping data through curl, writing to unexpected files. It looks like normal agentic behaviour from the outside. Skarn maps the full attack chain across MITRE ATLAS tactic-aligned stages and flags it.
What Skarn actually does
No upload. No network call by default. It reads the log files already on disk and produces a report. The report is yours - Skarn never sees it. Optional online checks are explicitly opt-in.
The same engine indexes every Claude Code, Cursor, Copilot, Gemini, and Codex session. "Which session did I fix that in?" answered in seconds, across all of them. It is the same tool that runs the security scan - one binary, both jobs.
Every detected credential is shown redacted, like wJal****EY. You see the type, the session, the risk score, and the context - not the raw secret.
It tells you what leaked and where. It does not auto-rotate credentials or make decisions for you. Rotation, session hygiene, and prompt patterns stay with you. An optional pre-execution guard hook - for Claude Code, Cursor, Codex CLI, and GitHub Copilot - can block a bad tool call before it runs.
Quick start
macOS, Windows, Linux - Intel and ARM. Single file, no dependencies. The binary is public and installs with no account: brew install skarn-security/tap/skarn, or grab a binary. skarn assess needs no account; skarn check uses a free license from getskarn.com/free; the paid tiers add the org controls.
Skarn finds the session logs automatically. No path configuration needed for most setups.
Everything is masked. Nothing is uploaded. The report stays on your machine.
More for your team: CTO and VP Eng, CISO and CSO, Containers and CI
Read the docs or book a team assessment
Run it on your own session history and see your own exposure - then decide what to rotate. The free tier includes the full local product under a registered license; the paid tiers add the org controls. Install it now: brew install skarn-security/tap/skarn, or download a binary.