How is it different from a git secret scanner?

A git secret scanner such as gitleaks or trufflehog scans repositories and commit history. An AI session security scanner scans the assistant session logs those tools never look at. A credential pasted into a chat and never committed is invisible to a git scanner and detectable by a session scanner. They are complementary, not competing.

Is it the same as DLP?

No. Endpoint and network data loss prevention watch email, uploads, and endpoints. Neither inspects the local AI coding session transcript, so secrets pasted into an assistant fall outside DLP coverage. An AI session security scanner is the layer that covers this shadow-AI surface.

Guide

What is an AI coding session security scanner?

Q: What is an AI coding session security scanner?

An AI coding session security scanner is a tool that reads the local session logs AI coding assistants write to disk - Claude Code, Cursor, Codex CLI, Gemini CLI, and GitHub Copilot - and surfaces leaked credentials and the prompt-injection-to-exfiltration attacks that exploit them. It inspects a surface that git secret scanners and endpoint DLP do not: the AI chat transcript on the developer machine.

An AI coding session security scanner reads the local session logs that AI coding assistants write to disk and surfaces leaked credentials and the attacks that exploit them. It inspects the AI chat transcripts on the developer machine - Claude Code, Codex CLI, Cursor, Gemini CLI, and VS Code GitHub Copilot - a surface that git secret scanners and endpoint DLP do not cover.

Skarn is an AI coding session security scanner. It runs locally as a single binary, with no upload and no network call by default.

Last updated 2026-07-03.

What it does

Reads on-disk AI session logs

It parses the session transcripts the assistants persist locally, including the SQLite state databases Cursor and Copilot use, without touching your git repository.

Detects leaked credentials

API keys, cloud keys, database URIs, OAuth tokens, and .env contents pasted into a prompt - across 200-plus credential types - shown redacted, never in full.

Correlates attack chains

Prompt injection to secret read to exfiltration, correlated across MITRE ATLAS tactic-aligned stages and mapped to the OWASP Top 10 for LLM Applications 2025 and CWE, with a 0-100 risk score per session and team.

How it differs from tools you already run

vs git secret scanners (gitleaks, trufflehog): They scan repositories and commit history; a session scanner scans the AI logs those tools never look at. Complementary layers - see the tools comparison.
vs endpoint and network DLP: DLP watches email, uploads, and endpoints, not the local AI session transcript. The session scanner covers that shadow-AI surface - see the shadow AI DLP guide.
vs inline AI-gateway or proxy tools: Those see traffic in transit; a session scanner reads the persisted local transcript after the fact, including tool-call detail, for forensic reconstruction and CI gating.

See it on your data

Book a scoped, consent-first exposure assessment and watch an AI session security scanner run on a sample of your developer machines.

Book an exposure assessment Read the how-to guide

[email protected]