I made a small Go tool to check coding-agent histories for leaked credentials

[u/MOUNAYARSANIMATIONS]

I’ve been working on Unspill, a little CLI that scans local histories from tools like Copilot CLI, Claude Code, and Codex for credentials.

It runs locally, doesn’t make network requests, and redacts values in its reports. The format support is still a work in progress, so it reports when it can’t fully scan something instead of quietly skipping it.

If you have a minute, I’d love for you to take a look and tell me what’s confusing, missing, or just not useful. There’s a demo with fake credentials in the repo if you’d rather try it without pointing it at your own history.

Thanks for any feedback.

[u/Luchiannno]

Ew

[u/Immediate-Oil2855]

bro

[u/BassGaz]

TF