Show HN: Claude Scrub - redact secrets from Claude Code history on disk

Developer overflowy released claude-scrub, an open-source Go tool that scans the plain-text history Claude Code stores under ~/.claude and replaces detected secrets with labels such as DB_PASSWORD=[REDACTED:db_password]. The tool covers session transcripts including subagent and tool-result files, prompt history, the paste cache, file history and shell snapshots, drawing on four sources ranked from a user secrets file and --env-file down to gitleaks rules covering 200+ token formats, and it can run automatically via a SessionEnd hook in ~/.claude/settings.json. It requires Go 1.26 or newer, ships builds for darwin_amd64, darwin_arm64, linux_amd64, linux_arm64, windows_amd64.exe and windows_arm64.exe, skips files modified in the last 10 minutes unless --min-age is changed, and refuses to write without a terminal unless --force is passed.

Claude Code keeps everything you and the model saw in plain text under ~/.claude . That includes every cat .env , every config file it read and every token you pasted into a prompt. claude-scrub finds the secrets in that history and replaces each one with a label: DB PASSWORD= REDACTED:db password It covers session transcripts subagents and tool results included , prompt history, the paste cache, file history and shell snapshots. It leaves settings, plugins and live session state alone. Download the file for your platform from the releases page https://github.com/overflowy/claude-scrub/releases/latest , make it executable, and put it on your PATH . With the GitHub CLI, on an Apple Silicon Mac: gh release download -R overflowy/claude-scrub -p ' darwin arm64' chmod +x claude-scrub darwin arm64 mv claude-scrub darwin arm64 ~/.local/bin/claude-scrub The other builds are darwin amd64 , linux amd64 , linux arm64 , windows amd64.exe and windows arm64.exe . checksums.txt has their SHA-256 sums. The macOS binaries aren't signed, so if macOS refuses to run one, clear the quarantine flag with xattr -d com.apple.quarantine ~/.local/bin/claude-scrub . Needs Go 1.26 or newer. go install github.com/overflowy/claude-scrub@latest This puts the binary in $ go env GOPATH /bin , usually ~/go/bin . Needs Go 1.26 or newer and Task https://taskfile.dev . git clone https://github.com/overflowy/claude-scrub cd claude-scrub task install builds ~/.local/bin/claude-scrub task --list shows the other tasks. task check runs gofmt, go fix, go vet and the tests without changing anything. Start with a dry run. It prints a table of labels with how many values and occurrences it found, and changes nothing. claude-scrub --dry-run To see why something was flagged, ask for the text around each value of a label. The snippet is redacted too. claude-scrub -n --explain token When the report looks right, run it for real. It asks before writing. claude-scrub Without a terminal to confirm on, it refuses to write unless you pass --force . It skips files modified in the last 10 minutes, so it won't rewrite a session that's still running. Change that with --min-age . Paths given as arguments are scanned whatever their age. Add a SessionEnd hook to ~/.claude/settings.json and each session gets scrubbed when it ends. Use the path you installed the binary to: { "hooks": { "SessionEnd": { "hooks": { "type": "command", "command": "~/.local/bin/claude-scrub --hook" } } } } The hook redacts that session's transcript, its subagent and tool result files, and history.jsonl . It prints nothing unless it redacted something or failed. Put values that must always go in ~/.config/claude-scrub/secrets , one label=value per line. You can also point --env-file at a .env , shell or YAML file and it picks out the secrets in it. Put false positives in ~/.config/claude-scrub/allow , one value per line. label:NAME skips a whole label. There are four sources, from most to least trusted: 1. Your secrets file and any --env-file . 2. Values assigned to secret-looking names, such as DB PASSWORD=... , "apiKey": "..." or --password=... . The value has to look like a secret: at least 8 characters, a mix of character types, and not a path, date, placeholder or piece of code. 3. Passwords in URLs postgres://user:pass@host and Authorization: Bearer or Basic headers. 4. The gitleaks https://github.com/gitleaks/gitleaks rules, which know about 200+ token formats AWS, GitHub, Slack, OpenAI, private keys and more . Every value found anywhere gets redacted everywhere. If a password shows up once as DB PASSWORD=... and later on its own in a psql command, both go. Transcripts are JSON lines, and the same secret can sit in them as is, escaped once, or escaped twice when a tool returned JSON. claude-scrub looks for all three forms and only cuts where the cut can't break an escape sequence. Any line that would stop being valid JSON is left alone and reported. Every other byte stays the same. Each file is written to a temporary file and renamed into place, keeping its mode and modification time. If a running session appends to a file while it's being rewritten, claude-scrub notices and tries again. A dry run over 1.3 GB of history takes about 5 seconds on an 18-core M5 Pro. Most lines contain none of the keywords any rule needs, so they're dropped before a regex runs. Very long lines, like a minified bundle a tool printed, are cut into windows around each keyword. - Detection is best effort. A password that never appears next to a secret-looking name is missed unless it's in your secrets file. The same goes for derived values, like a base64-encoded id:key . - --explain and --peek print text from your history. Everything found is redacted in it, but anything the detectors missed shows as is. - Redaction is permanent. There is no backup, since a backup would hold the secrets.