AI coding sessions from Claude Code and others store API keys in plaintext

On October 31, 2026, DEV Community's AI section carried a post sourced from ReclaimLLM, originally published at reclaimllm.com/blogs/ai-coding-transcripts-secret-store. Its central claim is that AI coding tools including Claude Code, Codex, Cursor, and Copilot write every session to local disk as a plaintext JSONL file, and that any API key pasted into a session is stored there as well. As a result, the article argues, the real leak surface is typically the transcript copy sitting on the laptop rather than the model provider itself.

The piece goes on to publish a per-tool path table showing where each tool leaves its transcripts on disk, along with a scan recipe for finding pasted secrets. For remediation it prescribes a fixed order of operations: rotate the exposed keys first, then purge the stored transcript files, and finally add guardrails to prevent a recurrence. The article also cites a 2026 GitGuardian analysis reporting a 3.2% leak rate in public commits tied to Claude Code, against an overall baseline of 1.5%.

As of this report, there is no mention of responses from the vendors involved, patches to the transcript-writing behavior, or any follow-up work. The matter therefore stands at the point where the plaintext storage practice and its associated exposure have been publicly described, with the proposed remedy resting on user-side key rotation and cleanup rather than any confirmed tool-side fix.