Show HN: Check your Claude Code, Codex and Cursor sessions for secrets

Category: security

Tags: secrets-detection, ai-agents, security-tooling, claude-code, local-first

Score: 6.8/10 (Innovation: 6, Technical: 7, Documentation: 8, Utility: 6)

Stroq scans local AI coding agent session logs (Claude Code, Codex, Cursor) for credentials found on the machine, reporting which keys appeared in tool args or outputs without revealing values. It also installs hooks to block outbound calls containing known secrets in future sessions, with provenance tracing back to earlier tool output. Interesting because it addresses a real, emerging attack surface—secrets leaking through agent sessions—with a local-first, no-telemetry design.

Target audience: developers using AI coding agents, security engineers, devops

Repository: https://github.com/AGGIB/Stroq · TypeScript · Apache-2.0 · 19 stars

View on Hacker News