shg, the shell guard

Shell history and AI coding assistant transcripts are a major source of leaked credentials, according to developer Panayotis Vrypanis, who created shg (the shell guard) v0.2.6 to scan shell/REPL histories, environment variables, and AI agent session files for API keys, tokens, and passwords. The tool runs entirely locally with no network access, redacts findings by default, and can prevent secrets from being saved to zsh history. Vrypanis warns that AI assistants like Claude Code, Codex, Gemini CLI, and Copilot CLI keep full session transcripts on disk that may contain secrets from .env files or terminal output.

Shell history is one source of leaked credentials. Commands containing API keys, bearer tokens, passwords, or connection strings are often written to history files without much thought. We shouldn’t do it, but, let’s admit it, we all do it, especially when we feel safe, on a computer entirely under our control. export OPENAI API KEY=sk-... curl -H "Authorization: Bearer ghp ..." https://api.example.com psql postgres://alice:password@example.com/db Best practices There are best practices and tricks that will help you keep secrets from bash/zsh/fish history. I found "Hiding secret keys from shell history: Part 1" https://medium.com/@prasincs/hiding-secret-keys-from-shell-history-part-1-5875eb5556cc to be extremely useful. But it’s not just shell history. It may be a SELECT statement in your ~/.mysql history , or a quick test stored permanently in your ~/.python history , and so on. And recently, AI coding assistants have introduced one more secret-concentration point. Claude Code, Codex, Gemini CLI, and Copilot CLI keep full session transcripts on disk; transcripts that may contain secrets copied from .env files, terminal output, or configuration files. User: Connect to the production database. Tool output: DATABASE URL=postgres://alice:password@example.com/db OPENAI API KEY=sk-... AWS SECRET ACCESS KEY=... shg scans these locations for credentials, and anything that looks like an API key or an access token. It scans shell and REPL histories, environment variables, AI agent command histories, and AI agent session transcripts. Everything runs locally, there is no network access or telemetry, and findings are redacted by default. For example, running shg scan reports secrets found in shell/REPL history files or environment variables: bash $ shg scan export OPENAI API KEY=s ... 5 ~/.zsh history:148 inline assign curl -H "Authorization: Bearer g ... 5... ~/.zsh history:576 auth header 2 finding s detected 2 high, 0 medium, 0 low . Remove flagged history entries and rotate affected credentials. shg deep scans AI agent transcripts and groups findings by session instead of by line: bash $ shg deep ~/.claude/projects/myapp/3f2c….jsonl known token ghp … 2345 3×, tool output …export GITHUB TOKEN=ghp … 2345… 1 secret s across 1 session file s . Rotate each credential, delete the affected session files, and make sure this directory is not synced, committed, or world-readable. If you are using zsh there is also a way to run shg on every command before it’s stored in history and prevent it from landing there if it contains secrets. bash the command executes normally, but it's not saved to history $ export GH TOKEN=ghp 381289xj 82j7nk 23 shg Warning: possible secret detected — not saved to history. shg can’t eliminate the risk of secret leaks. But it makes it easier to discover accidental exposure before history files or agent transcripts are backed up, synchronized, committed, or shared. shg is currently on v0.2.6 https://github.com/vrypan/shg and has been significantly improved since the last time /2026/05/09/shg-the-shell-guard/ I wrote about it.