Where does Claude Code store its session history?

Claude Code writes each session as a local JSONL transcript under your ~/.claude directory (and any config directory set via CLAUDE_CONFIG_DIR). Cursor and VS Code Copilot Chat store their chat in a local SQLite state database (state.vscdb). Gemini CLI and Codex CLI write their own local logs. All of it stays on the developer machine and is never scanned by git secret scanners.

Can git secret scanners like gitleaks or trufflehog find these secrets?

No. gitleaks and trufflehog scan git repositories and commit history. A credential a developer pastes into an AI chat and never commits never enters git, so it is invisible to those tools. It is a different surface - the AI session log on disk - which is what an AI session security scanner inspects.

How do I scan Claude Code history for leaked secrets?

Run an AI session security scanner over the local session store. Skarn does this with a single command, skarn check, which parses the on-disk logs of Claude Code, Cursor, Codex CLI, Gemini CLI, and GitHub Copilot, detects leaked credentials across 200-plus types, and shows every secret redacted. It runs locally and makes no network calls by default.

Guide

How to scan AI coding assistant sessions for leaked secrets

To audit your AI coding sessions for leaked credentials, scan the session logs your assistants write to disk - not your git repository. Claude Code, Codex CLI, Cursor, Gemini CLI, and GitHub Copilot each record chat history locally, and any API key, database URI, or .env value a developer pastes into a prompt is stored there in plaintext, outside every secret scanner pointed at git.

An AI coding session security scanner reads those on-disk logs and surfaces the leaked credentials. With Skarn it is one command, skarn check, run locally with no upload and no network call by default.

Last updated 2026-07-03.

Where AI coding assistants store session history

Every mainstream assistant persists chat history to the local disk. That store is the audit target.

Claude Code: Writes each session as a JSONL transcript under ~/.claude (plus any directory set in CLAUDE_CONFIG_DIR). Full prompts, tool calls, and outputs are retained.
Cursor and VS Code Copilot Chat: Store chat history in a local SQLite state database (state.vscdb) inside the editor's application-support directory.
Codex CLI and Gemini CLI: Write their own local session logs in the tool's config directory. Same principle: the transcript, including anything pasted in, lives on the machine.
GitHub Copilot CLI: Writes JSONL event logs under ~/.copilot (or COPILOT_HOME), separate from the VS Code Copilot Chat state database above.

How to scan Claude Code history for secrets

1. Point a session scanner at the local store

Traditional scanners take a repo path. An AI session scanner instead reads the assistant session directories directly. Skarn discovers them automatically for all 5 assistants.

2. Run the scan locally

With Skarn: skarn check. It parses every session, runs 248 detection rules across 200-plus credential types, and correlates multi-stage prompt-injection-to-exfiltration attack chains. Nothing is uploaded.

3. Review redacted findings by risk

Each finding is shown with the secret masked, attributed to the exact session and message, and scored on a 0-100 risk scale. Output is human-readable, JSON, or SARIF 2.1.0 for your SIEM.

4. Rotate and coach, then gate

Skarn surfaces exposure; your team rotates the exposed credential and coaches the developer. In CI, gate on severity or risk score so a leak fails the build.

What a session scan catches that git scanners miss

Uncommitted pasted credentials

A key pasted into a chat to debug an integration, never written to a file or committed. Invisible to gitleaks and trufflehog, obvious to a session scan. This is the most common shadow-AI leak.

Prompt-injection-to-exfiltration chains

Poisoned content that drives the assistant to read a secret and exfiltrate it through a tool call - correlated across MITRE ATLAS tactic-aligned stages, mapped to the OWASP Top 10 for LLM Applications 2025 and CWE.

Did your developers paste API keys into ChatGPT or Claude?

A session scan answers that question directly and with evidence, per developer and per session, instead of leaving it a guess. See also the shadow AI DLP guide.

Skarn surfaces exposure - it does not auto-remediate. Your team owns rotation, coaching, and policy. Visibility and evidence, not a black-box fix.

See what is leaking in your sessions

Book a scoped, consent-first exposure assessment and watch Skarn scan a sample of developer machines in your own environment. Nothing sent to a cloud.

Book an exposure assessment Compare the tools

[email protected]