1 Database Password, 46 Copies in Old Chats: How He Found Secrets Saved in Claude Code and Codex Logs
- Level Intermediate
- Setup1–3 hrs (estimated)
- Evidence Some evidence
- CostNot stated in source
- No-codeNo
What they did
Coding agents save every chat to your disk as plain text. Claude Code keeps about a month, and Codex had kept all of his since he installed it. When he checked, one database password showed up 46 times (22 of them the agent typing it into its own commands), plus an access token another 14 times. Now he pastes keys into files himself and his agent rules say never to print them. Since then, every session has had zero.
How it went
X post by @Bajanpunkw (Oct 26, 2026 UTC) with a screenshot: a database password appeared 46 times and a token 14 times; new rule gave zero after. Rotate any key you find, because deleting the logs doesn't undo a leak. He mentions a full rules article that isn't needed for this check
Worth knowing
- X post by @Bajanpunkw (Oct 26, 2026 UTC) with a screenshot: a database password appeared 46 times and a token 14 times; new rule gave zero after.
- Rotate any key you find, because deleting the logs doesn't undo a leak. He mentions a full rules article that isn't needed for this check.
Prompt
Cleaned version rewritten from the source — not a direct quote.
Search my local agent chat logs (~/.codex/sessions and ~/.claude/projects) for anything that looks like a password, API key or token. Report each file and how many times each secret appears, but print only the first 4 characters of any secret. Then suggest which keys I should rotate and add a rule to my agent instructions: never print or echo secrets.
Recommended
Try it in Grok Bot
Grok Bot can run this check through a coding agent on your computer and summarize what it finds.
- Copy the prompt (button below).
- Open Grok Bot chat and paste it. Replace any [bracketed] placeholders.
- Connect the listed tools (as needed) as connectors when Grok Bot asks.
- If the task repeats, ask: "Make this a daily routine."
Alternatives: the same prompt works in Claude Code, Codex, Claude, ChatGPT Agent, OpenClaw.
Set it up
Stack: Claude Code + Codex
- Read the original source for full context.
- Connect the tools your agent needs.
- Paste the prompt and replace [bracketed] placeholders.
- Run once manually and check the output before scheduling it.
Generic suggested steps, not from the source.
Evidence
X post by @Bajanpunkw (Oct 26, 2026 UTC) with a screenshot: a database password appeared 46 times and a token 14 times; new rule gave zero after. Rotate any key you find, because deleting the logs doesn't undo a leak. He mentions a full rules article that isn't needed for this check
Source: X · 2026-10-26 · Verified by us: not yet · Report broken or outdated