Show HN: Claude Scrub - redact secrets from Claude Code history on disk

Claude Code keeps everything you and the model saw in plain text under ~/.claude. That includes every cat .env, every config file it read and every token you pasted into a prompt. claude-scrub finds the secrets in that history and replaces each one with a label:

DB_PASSWORD=[REDACTED:db_password]

It covers session transcripts (subagents and tool results included), prompt history, the paste cache, file history and shell snapshots. It leaves settings, plugins and live session state alone.

Download the file for your platform from the releases page, make it executable, and put it on your PATH. With the GitHub CLI, on an Apple Silicon Mac:

gh release download -R overflowy/claude-scrub -p '*darwin_arm64'
chmod +x claude-scrub_*_darwin_arm64
mv claude-scrub_*_darwin_arm64 ~/.local/bin/claude-scrub

The other builds are darwin_amd64, linux_amd64, linux_arm64, windows_amd64.exe and windows_arm64.exe. checksums.txt has their SHA-256 sums. The macOS binaries aren't signed, so if macOS refuses to run one, clear the quarantine flag with xattr -d com.apple.quarantine ~/.local/bin/claude-scrub.

Needs Go 1.26 or newer.

go install github.com/overflowy/claude-scrub@latest

This puts the binary in $(go env GOPATH)/bin, usually ~/go/bin.

Needs Go 1.26 or newer and Task.

git clone https://github.com/overflowy/claude-scrub
cd claude-scrub
task install   # builds ~/.local/bin/claude-scrub

task --list shows the other tasks. task check runs gofmt, go fix, go vet and the tests without changing anything.

Start with a dry run. It prints a table of labels with how many values and occurrences it found, and changes nothing.

claude-scrub --dry-run

To see why something was flagged, ask for the text around each value of a label. The snippet is redacted too.

claude-scrub -n --explain token

When the report looks right, run it for real. It asks before writing.

claude-scrub

Without a terminal to confirm on, it refuses to write unless you pass --force.

It skips files modified in the last 10 minutes, so it won't rewrite a session that's still running. Change that with --min-age. Paths given as arguments are scanned whatever their age.

Add a SessionEnd hook to ~/.claude/settings.json and each session gets scrubbed when it ends. Use the path you installed the binary to:

{
  "hooks": {
    "SessionEnd": [
      { "hooks": [{ "type": "command", "command": "~/.local/bin/claude-scrub --hook" }] }
    ]
  }
}

The hook redacts that session's transcript, its subagent and tool result files, and history.jsonl. It prints nothing unless it redacted something or failed.

Put values that must always go in ~/.config/claude-scrub/secrets, one label=value per line. You can also point --env-file at a .env, shell or YAML file and it picks out the secrets in it.

Put false positives in ~/.config/claude-scrub/allow, one value per line. label:NAME skips a whole label.

There are four sources, from most to least trusted:

1. Your secrets file and any --env-file .
2. Values assigned to secret-looking names, such as DB_PASSWORD=... ,"apiKey": "..." or--password=... . The value has to look like a secret: at least 8 characters, a mix of character types, and not a path, date, placeholder or piece of code.
3. Passwords in URLs (postgres://user:pass@host ) andAuthorization: Bearer orBasic headers.
4. The gitleaks rules, which know about 200+ token formats (AWS, GitHub, Slack, OpenAI, private keys and more).

Every value found anywhere gets redacted everywhere. If a password shows up once as DB_PASSWORD=... and later on its own in a psql command, both go.

Transcripts are JSON lines, and the same secret can sit in them as is, escaped once, or escaped twice when a tool returned JSON. claude-scrub looks for all three forms and only cuts where the cut can't break an escape sequence. Any line that would stop being valid JSON is left alone and reported.

Every other byte stays the same. Each file is written to a temporary file and renamed into place, keeping its mode and modification time. If a running session appends to a file while it's being rewritten, claude-scrub notices and tries again.

A dry run over 1.3 GB of history takes about 5 seconds on an 18-core M5 Pro. Most lines contain none of the keywords any rule needs, so they're dropped before a regex runs. Very long lines, like a minified bundle a tool printed, are cut into windows around each keyword.

• Detection is best effort. A password that never appears next to a secret-looking name is missed unless it's in your secrets file. The same goes for derived values, like a base64-encoded id:key .
• --explain and--peek print text from your history. Everything found is redacted in it, but anything the detectors missed shows as is.
• Redaction is permanent. There is no backup, since a backup would hold the secrets.