Things we build and break in the open.

We built a secret scanner and pointed it at our own machine. It found our own keys.

Every AI coding agent you run, Claude Code, Cursor, Copilot and the rest, keeps a transcript of each session. Every file it reads for you, every command's output, everything you paste into a prompt: written to disk, in plaintext, indefinitely, in a directory almost nobody has ever opened.

We opened ours. Scanning the machine residoo was built on, 98 session files and 1.2 GB, found 151 potential secrets, including:

• 34 distinct JWT-shaped tokens, the kind of session tokens that surface while a login flow is being worked on, never committed anywhere because they were just said in a session
• a private key block, re-exposed 15 times across tool output
• 3 distinct AWS access key IDs, and here is the twist our own fact-check caught: the loudest one is AWS's official documented example id, planted by residoo's own test suite and echoed into the transcript every time the tests ran. The scanner caught its own development residue, which is the mechanism demonstrating itself: anything an agent reads, runs, or prints persists to disk in plaintext, immediately
• a database connection string with an embedded password

Almost none of it was ever in git, so no commit scanner would have flagged it. Tools like gitleaks and trufflehog are excellent, and they watch a different door. This material leaked through the conversation itself.

It isn't just us

Search Claude Code's own issue tracker and the pattern repeats, filed by strangers who never heard of residoo. A developer grepped a .dev.vars file for something unrelated and a live Cloudflare API token was printed straight into the transcript, despite an explicit CLAUDE.md rule telling the agent never to do that (issue #44868). Another had brokerage API keys read out with a plain Get-Content and had to revoke and reissue four key pairs afterward, despite their own memory file explicitly forbidding it (#59094). A third watched a Pinecone key get echoed by cat ~/.claude/settings.json, the agent's own after-the-fact apology quoted back at them: "direct violation of your global 'never display credentials' rule" (#58043). All three were closed not-planned: the model printing back what it just read is normal tool behavior, not a bug the harness intends to fix. That gap is the whole reason residoo exists.

What it is

residoo is a free, MIT-licensed command-line scanner for exactly this blind spot. It reads your local agent transcripts, matches them against high-confidence credential patterns, and reports what it finds with every value redacted. It is zero-dependency JavaScript, roughly 8,000 lines for the core engine plus another 12,000 spread across 43+ per-agent source adapters (mostly repetitive per-format parsing, not complexity), and makes zero network calls while scanning; there is no HTTP client in the scan path to make one with. Findings distinguish distinct secrets from re-exposures, so one echoed key never reads as eighteen leaks, and likely placeholder text is set aside instead of inflating the count.

When it finds something real, --seal encrypts the affected transcripts into a local AES-256-GCM vault whose manifest is itself encrypted. Originals are never touched: verifying the restore and deleting the plaintext stays a human decision. And if you want the sealed vault kept somewhere durable and provider-redundant, it can optionally hand the ciphertext to CloudRoam. That last part is the only network feature in the scan path, it is off unless you ask, and it ships encrypted bytes only.

Three more shapes have grown around that core since the first release. residoo watch runs continuously in the background and alerts the moment a new secret is written, instead of waiting for you to remember to scan. residoo mcp runs residoo as an MCP server, so Claude Code can query findings and manage the rotation ledger conversationally, in the same conversation that might have caused the leak. And residoo cred attacks the problem one step upstream: it injects a keychain-stored credential into a narrowly allow-listed command so you never have to paste the raw value into chat in the first place, the model only ever sees an exit code and a line count, never the secret.

Benchmarked against the whole field, losses included

Because "trust our scanner" is not an argument, residoo ships a public benchmark in its own repo: a deterministic synthetic corpus in the real transcript format (pattern-true fakes only) scored eight tools on identical data, with a zero-egress monitor watching every scan. We published it while losing rows: the first run had residoo at 71 percent, behind agentsweep, and beaten five-to-zero by gitleaks on base64-encoded plants. Then the gaps were fixed as general, documented mechanisms and re-run in public, most recently after stress-testing the benchmark's own precision claim against real false-positive patterns from gitleaks' and TruffleHog's issue trackers, which found and fixed one genuine bug in residoo's own boundary-join logic. It cost nothing on the scoreboard, which is the point: the benchmark exists to find residoo's problems too, not just the competition's.

Four more tools (Betterleaks, Kingfisher, whatileaked, detect-secrets) sit between 56 and 71 percent; GitGuardian's ggshield is documented rather than scored because it requires a server account by design. Every number comes from the post-review rerun, every dated fix stays in the published history so the before and after is auditable, the methodology survived adversarial fairness reviews (including re-running TruffleHog exactly their way and getting byte-identical findings), and one benchmark point was deliberately given up where an anti-fabrication guard demanded it. Full corpus generator, harness, raw outputs, and results: bench/ in the repo. It is our benchmark; the honest response to that objection is that everything needed to prove us wrong is published.

Held to its own standard

A tool that asks to be trusted near your secrets should expect hostility. Before release, residoo went through three independent adversarial review passes, which caught real bugs: an ANSI-escape injection in its own report output, an 818 MB transcript the first version could not read at all, and a symlink edge case that silently skipped files. Each fix is documented in the repository's SECURITY.md along with how it was verified, so you are not asked to take our word for anything.

Why a backup company built a secret scanner

Because it is the same discipline. CloudRoam's whole premise is that claims are cheap and receipts are not: an unreadable vault you can prove restores, an agent gate you can watch refuse a destructive command, a restore test recorded after every run. residoo applies that discipline to a place nobody was looking. If it never sends a single user to CloudRoam, it still made the ecosystem measurably safer, and that is a fine outcome for a lab.