Show HN: Which of your secrets did your coding agent send?

Category: security

Tags: security, ai-agents, secret-scanning, claude-code, codex, typescript, local-first

Score: 7.8/10 (Innovation: 8, Technical: 8, Documentation: 8, Utility: 7)

Stroq scans local Claude Code, Codex CLI, and Cursor session transcripts to detect whether credentials from your machine (e.g., AWS keys, .env values) appear in agent tool calls, reporting which credential and tool call without exposing the secret. It also provides hooks to block future outbound calls containing known secrets. This addresses a real and growing security gap in AI coding agent workflows, with thoughtful provenance tracking and transparent limits on what it can prove.

Target audience: Developers using AI coding agents, security engineers, DevOps

Repository: https://github.com/AGGIB/Stroq · TypeScript · Apache-2.0 · 19 stars

View on Hacker News