Residoo

**Find secrets leaking through your AI coding agent's session history.**

[](https://www.npmjs.com/package/residoo) [](https://github.com/dandovdub/residoo/actions/workflows/ci.yml) [](LICENSE) [](package.json) [](package.json)

Every time Claude Code, Cursor, or a similar tool reads a file, runs a command, or browses a page on your behalf, it writes a transcript of the whole session to disk, including the contents of whatever it touched. If that ever included a `.env` file, a config with a real key in it, or a login token captured during testing, that credential is now sitting in plaintext, indefinitely, in a place almost nobody thinks to check.

residoo scans those transcripts and tells you what's in them.

$ residoo scan

⚠  17 potential secrets found across 3 files
   87 files scanned (1.2 GB) · sources: claude-code
   oldest match ~8d old · most recent ~0d old

    16  [high]  AWS Access Key ID   (1 distinct value, re-exposed 15× across tool output)
     1  [high]  Private key block

Values are redacted in this report (first/last 4 characters only). Nothing
scanned here left your machine; residoo makes no network calls.

Why this, and not a git sec