{"slug": "shg-the-shell-guard", "title": "shg, the shell guard", "summary": "Shell history and AI coding assistant transcripts are a major source of leaked credentials, according to developer Panayotis Vrypanis, who created shg (the shell guard) v0.2.6 to scan shell/REPL histories, environment variables, and AI agent session files for API keys, tokens, and passwords. The tool runs entirely locally with no network access, redacts findings by default, and can prevent secrets from being saved to zsh history. Vrypanis warns that AI assistants like Claude Code, Codex, Gemini CLI, and Copilot CLI keep full session transcripts on disk that may contain secrets from .env files or terminal output.", "body_md": "Shell history is one source of leaked credentials. Commands containing API keys, bearer tokens, passwords, or connection strings are often written to history files without much thought.\n\nWe shouldn’t do it, but, let’s admit it, we all do it, especially when we feel safe, on a computer entirely under our control.\n\n```\nexport OPENAI_API_KEY=sk-...\ncurl -H \"Authorization: Bearer ghp_...\" https://api.example.com\npsql postgres://alice:password@example.com/db\n```\n\nBest practices\n\nThere are best practices and tricks that will help you keep secrets from bash/zsh/fish history.\nI found [\"Hiding secret keys from shell history: Part 1\"](https://medium.com/@prasincs/hiding-secret-keys-from-shell-history-part-1-5875eb5556cc)\nto be extremely useful.\n\nBut it’s not just shell history. It may be a `SELECT`\n\nstatement in your `~/.mysql_history`\n\n, or a quick test stored permanently in your `~/.python_history`\n\n, and so on.\n\nAnd recently, AI coding assistants have introduced one more secret-concentration point. Claude Code, Codex, Gemini CLI, and Copilot CLI keep full session transcripts on disk; transcripts that may contain secrets copied from `.env`\n\nfiles, terminal output, or configuration files.\n\n```\nUser: Connect to the production database.\n\nTool output:\nDATABASE_URL=postgres://alice:password@example.com/db\nOPENAI_API_KEY=sk-...\nAWS_SECRET_ACCESS_KEY=...\n```\n\n`shg`\n\nscans these locations for credentials, and anything that looks like an API key or an access token. It scans shell and REPL histories, environment variables, AI agent command histories, and AI agent session transcripts. Everything runs locally, there is no network access or telemetry, and findings are redacted by default.\n\nFor example, running `shg scan`\n\nreports secrets found in shell/REPL history files or environment variables:\n\n``` bash\n$ shg scan\n\n[!!!] export OPENAI_API_KEY=s*************...************** 5\n      ~/.zsh_history:148 [inline_assign]\n\n[!!!] curl -H \"Authorization: Bearer g*************...************** 5...\n      ~/.zsh_history:576 [auth_header]\n\n2 finding(s) detected (2 high, 0 medium, 0 low).\nRemove flagged history entries and rotate affected credentials.\n```\n\n`shg deep`\n\nscans AI agent transcripts and groups findings by session instead of by line:\n\n``` bash\n$ shg deep\n\n~/.claude/projects/myapp/3f2c….jsonl\n  [!!!] known_token   ghp_****…****2345   (3×, tool_output)\n        …export GITHUB_TOKEN=ghp_****…****2345…\n\n1 secret(s) across 1 session file(s).\nRotate each credential, delete the affected session files, and make sure\nthis directory is not synced, committed, or world-readable.\n```\n\nIf you are using `zsh`\n\nthere is also a way to run `shg`\n\non every command before it’s stored in history and prevent it from landing there if it contains secrets.\n\n``` bash\n# the command executes normally, but it's not saved to history\n\n$ export GH_TOKEN=ghp_381289xj_82j7nk_23\n[shg] Warning: possible secret detected — not saved to history.\n```\n\n`shg`\n\ncan’t eliminate the risk of secret leaks. But it makes it easier to discover accidental exposure before history files or agent transcripts are backed up, synchronized, committed, or shared.\n\n[shg is currently on v0.2.6](https://github.com/vrypan/shg) and has been significantly improved since [the last time](/2026/05/09/shg-the-shell-guard/) I wrote about it.", "url": "https://wpnews.pro/news/shg-the-shell-guard", "canonical_source": "https://blog.vrypan.net/2026/07/13/260713-shg-the-shell-guard/", "published_at": "2026-07-13 14:35:08+00:00", "updated_at": "2026-07-14 19:21:58.541648+00:00", "lang": "en", "topics": ["ai-tools", "ai-safety", "developer-tools"], "entities": ["shg", "Claude Code", "Codex", "Gemini CLI", "Copilot CLI", "OpenAI"], "alternates": {"html": "https://wpnews.pro/news/shg-the-shell-guard", "markdown": "https://wpnews.pro/news/shg-the-shell-guard.md", "text": "https://wpnews.pro/news/shg-the-shell-guard.txt", "jsonld": "https://wpnews.pro/news/shg-the-shell-guard.jsonld"}}