Things we build and break in the open.

We built a secret scanner and pointed it at our own machine. It found our own keys.

Every AI coding agent you run, Claude Code, Cursor, Copilot and the rest, keeps a transcript of each session. Every file it reads for you, every command's output, everything you paste into a prompt: written to disk, in plaintext, indefinitely, in a directory almost nobody has ever opened.

We opened ours. Scanning the machine residoo was built on, 98 session files and 1.2 GB, found 151 potential secrets, including:

• 34 distinct JWT-shaped tokens, the kind of session tokens that surface while a login flow is being worked on, never committed anywhere because they were just said in a session
• a private key block, re-exposed 15 times across tool output
• 3 distinct AWS access key IDs, and here is the twist our own fact-check caught: the loudest one is AWS's official documented example id, planted by residoo's own test suite and echoed into the transcript every time the tests ran. The scanner caught its own development residue, which is the mechanism demonstrating itself: anything an agent reads, runs, or prints persists to disk in plaintext, immediately
• a database connection string with an embedded password

Almost none of it was ever in git, so no commit scanner would have flagged it. Tools like gitleaks and trufflehog are excellent, and they watch a different door. This material leaked through the conversation itself.

What it is

residoo is a free, MIT-licensed command-line scanner for exactly this blind spot. It reads your local agent transcripts, matches them against high-confidence credential patterns, and reports what it finds with every value redacted. It is around 700 lines, has zero dependencies and makes zero network calls while scanning; there is no HTTP client in the scan path to make one with. Findings distinguish distinct secrets from re-exposures, so one echoed key never reads as eighteen leaks, and likely placeholder text is set aside instead of inflating the count.

When it finds something real, --seal encrypts the affected transcripts into a local AES-256-GCM vault whose manifest is itself encrypted. Originals are never touched: verifying the restore and deleting the plaintext stays a human decision. And if you want the sealed vault kept somewhere durable and provider-redundant, it can optionally hand the ciphertext to CloudRoam. That last part is the only network feature in the tool, it is off unless you ask, and it ships encrypted bytes only.

Benchmarked against the whole field, losses included

Because "trust our scanner" is not an argument, residoo ships a public benchmark in its own repo: a deterministic synthetic corpus in the real transcript format (pattern-true fakes only) scored eight tools on identical data, with a zero-egress monitor watching every scan. We published it while losing rows: the first run had residoo at 71 percent, behind agentsweep, and beaten five-to-zero by gitleaks on base64-encoded plants. Then the gaps were fixed as general, documented mechanisms and re-run in public.

Four more tools (Betterleaks, Kingfisher, whatileaked, detect-secrets) sit between 58 and 67 percent; GitGuardian's ggshield is documented rather than scored because it requires a server account by design. Every number comes from the post-review rerun, both versions of residoo stay in the published tables so the before and after is auditable, the methodology survived adversarial fairness reviews (including re-running TruffleHog exactly their way and getting byte-identical findings), and one benchmark point was deliberately given up where an anti-fabrication guard demanded it. Full corpus generator, harness, raw outputs, and results: bench/ in the repo. It is our benchmark; the honest response to that objection is that everything needed to prove us wrong is published.

Held to its own standard

A tool that asks to be trusted near your secrets should expect hostility. Before release, residoo went through three independent adversarial review passes, which caught real bugs: an ANSI-escape injection in its own report output, an 818 MB transcript the first version could not read at all, and a symlink edge case that silently skipped files. Each fix is documented in the repository's SECURITY.md along with how it was verified, so you are not asked to take our word for anything.

Why a backup company built a secret scanner

Because it is the same discipline. CloudRoam's whole premise is that claims are cheap and receipts are not: an unreadable vault you can prove restores, an agent gate you can watch refuse a destructive command, a restore test recorded after every run. residoo applies that discipline to a place nobody was looking. If it never sends a single user to CloudRoam, it still made the ecosystem measurably safer, and that is a fine outcome for a lab.