Do AI coding assistants store my prompts and secrets on disk?

Yes. Every mainstream AI coding assistant writes its conversation history to a local file in cleartext, and that file holds whatever was pasted into the prompt, including API keys, database URIs and .env contents. Claude Code writes JSONL transcripts under ~/.claude/projects/. Codex CLI writes rollout-*.jsonl under ~/.codex/sessions/. Cursor keeps chat in the SQLite database state.vscdb and agent transcripts under ~/.cursor/projects. The GitHub Copilot CLI writes events.jsonl under ~/.copilot/session-state/. This is separate from whatever the vendor retains server-side: the local copy exists regardless of the vendor's retention setting.

Where does Claude Code store its session history?

Claude Code writes one JSONL transcript per session under ~/.claude/projects/, with a subdirectory per working directory. Setting CLAUDE_CONFIG_DIR moves that whole tree. The transcript holds full prompts, tool calls and outputs in cleartext.

Can I delete or relocate these files?

Most assistants accept an environment variable that relocates the whole store: CLAUDE_CONFIG_DIR, CODEX_HOME, COPILOT_HOME, GROK_HOME, KIMI_CODE_HOME. Relocating is not redaction. The file is still cleartext at the new path, so a pasted credential stays readable until it is rotated. Deleting a transcript also does not rotate the credential it held.

How do I check whether a credential is sitting in one of these files?

Run Skarn. It discovers every store listed here automatically, parses the local session logs, and reports each detected credential with the value masked, attributed to the session and message that leaked it. The command is skarn check and it makes no network call by default.

Guide

Where AI coding assistants store your prompts on disk

Yes, AI coding assistants store your prompts on disk, in cleartext, on the developer's own machine. Each one keeps a conversation history file so it can resume a session, and that file holds whatever was pasted into the prompt: an API key, a database URI, the contents of a .env. The table below gives the exact path, file format and relocation variable for each of the 10 assistants Skarn reads.

This is separate from what the vendor keeps server-side. A zero-retention or no-training setting governs the vendor's copy, not this one. The local file exists either way, it is readable by anything running as that user, and it is backed up by whatever backs up the home directory.

Paths verified 2026-09-01. Last updated 2026-09-04.

The session store, per assistant

Paths are written as they resolve on macOS and Linux. On Windows, a ~/Library/Application Support or ~/.config prefix becomes %APPDATA%. GitHub Copilot takes two rows because the CLI and VS Code agent mode keep separate stores; they are one assistant in the count of 10.

Assistant	What it writes	Format	Relocate with
Claude Code	`~/.claude/projects/<dir>/*.jsonl`	JSONL transcript, one per session	`CLAUDE_CONFIG_DIR`
Codex CLI	`~/.codex/sessions/rollout-*.jsonl`, also `.jsonl.zst`	JSONL rollout, optionally zstd-compressed	`CODEX_HOME`
Gemini CLI	`~/.gemini/tmp/<dir>/chats/session-*.json` or `.jsonl`, plus `logs.json`	Chat document and a separate prompt log	None
Cursor	`~/Library/Application Support/Cursor/User/state.vscdb`, plus `~/.cursor/projects/*.jsonl`	SQLite editor state, plus JSONL agent transcripts	None
GitHub Copilot (VS Code)	`~/Library/Application Support/Code/User/state.vscdb`, plus `workspaceStorage//GitHub.copilot-chat/transcripts/.jsonl` and the chat-session journals beside it	SQLite editor state, plus JSONL transcripts	None
GitHub Copilot CLI	`~/.copilot/session-state/<id>/events.jsonl`	JSONL event log	`COPILOT_HOME`
Grok Build	`~/.grok/sessions/<dir>/<id>/chat_history.jsonl`, plus `prompt_history.jsonl`	JSONL transcript, plus a per-directory prompt log	`GROK_HOME`
Grok Bot	`~/Library/Application Support/Grok Bot/sand-client-persistence/*.blob`	Cleartext transcript replica, one file per conversation	None
Kimi Code CLI	`~/.kimi-code/sessions/<dir>/<id>/agents/<agent>/wire.jsonl`, plus `user-history/*.jsonl`	JSONL transcript per agent, plus a prompt log	`KIMI_CODE_HOME`
Antigravity	`~/.gemini/antigravity-cli/brain/<id>/.system_generated/logs/transcript_full.jsonl`, plus `~/Library/Application Support/Antigravity/User/state.vscdb`	JSONL transcript, plus SQLite editor state	None
OpenCode	`~/.local/share/opencode/`, both `opencode*.db` and stored JSON	SQLite database and JSON storage	`XDG_DATA_HOME`

Paths verified 2026-09-01 against each vendor's own source or documentation, and re-checked on a schedule: a row older than 45 days fails Skarn's build. This is the same table the scanner discovers from, so a path that moves upstream is a bug in the product, not just in this page.

Why this matters more than vendor retention

The local copy is not covered by your retention setting

Turning off training or buying a zero-retention plan changes what the vendor keeps. It does not stop the assistant writing the transcript to the developer's disk, because the assistant needs that file to resume the session.

No git scanner reads these paths

gitleaks and trufflehog scan repositories and commit history. A key pasted into a chat and never committed never enters git, so it is invisible to them. Different surface, different tool. See the tools comparison.

Relocating is not redaction

The environment variables in the table move the store. They do not encrypt it or strip anything out of it. A credential in a transcript stays valid until somebody rotates it, wherever the file lives.

Deleting the file does not close the exposure

If a key reached a transcript, treat it as exposed and rotate it. Removing the transcript afterwards is housekeeping, not remediation.

How to check what is actually in there

Reading these files by hand does not scale past one machine, and grepping for sk- finds the credential types you already thought of.

Run a scan

Skarn discovers every store in the table automatically, parses each format, and runs 248 detection rules across 200-plus credential types. The command is skarn check. It runs locally and makes no network call by default.

Read findings with the value masked

Every reported secret is shown truncated, attributed to the exact session and message, and scored on a 0-100 risk scale. Output is text, JSON, or SARIF 2.1.0 for a SIEM.

Then rotate

Skarn surfaces the exposure. Your team rotates the credential and coaches the developer. In CI, gate on severity or risk score so a leak fails the build.

The free tier includes the full local product under a registered license, issued at getskarn.com/free. Install instructions are on the install page.