# After the agent-tool breach, I asked: where do my API keys actually live? > Source: > Published: 2026-10-21 06:58:09+00:00 A few days ago, an agent-tool vendor disclosed a breach that exposed provider API keys stored in its console workspaces. My first thought wasn't about their infrastructure. It was much more embarrassing: *Which keys do I even have, and where are they stored?* I couldn't answer that in under a minute. And I suspect most developers can't. A provider key gets pasted into one agent tool's config, then another's, then an `.env` file, then shell history — and every copy is another place it can leak from, and another line on the bill if someone abuses it. So I built a small tool that answers the question locally: **keymap**. One command, no dependencies, no network: ``` python -m keymap ``` It scans the config files your agent tools, CLIs and shells actually read — `~/.claude.json`, `~/.codex/config.toml`, `~/.env`, shell rc files and history, `~/.aws/credentials`, and friends — and reports: `*_API_KEY` / `*_TOKEN` / `*_SECRET` variable it doesn't recognise),`chmod 600` it),`git add .` away from a commit — or already tracked. It finishes with a rotation checklist: the exact revoke page for every provider it found. After a vendor breach, that's the difference between a scavenger hunt and a checklist. `sk-ant-…`) plus a SHA-256 fingerprint prefix, so you can recognise the The repo ships `examples/demo-home/` — a fake home with the same Anthropic key in two files, an OpenAI key in `.env` *and* shell history, a GitHub token, and a world-readable `.env`: ``` sh examples/run-demo.sh ``` If you run it on your real home and find a key in five places, you're not careless — you're normal. That's exactly why I built it.