Built with SvelteKit 2 and TypeScript. Sharing the architecture because the interesting part is where the crypto sits.

Everything encrypts in the browser with AES-256-GCM (Web Crypto) before it ever leaves the page. The decryption key is generated client-side and lives in the URL fragment after the #, which browsers never send to the server. So my SvelteKit endpoints and the MongoDB behind them only ever hold an opaque blob. Even I cannot read what people paste.

On the Svelte side: encryption runs client-side before the form action fires, the ciphertext plus a salt is all that hits the server, and the key never touches a +page.server.ts. Password-protected pastes add a PBKDF2 layer at 100k iterations. There is burn-after-read, expiry from one hour to never, and no accounts or cookies.

Open source (AGPL-3) and self-hostable. Marking this as self-promotion per rule 4.

Repo: https://github.com/Ishannaik/CloakBin Live: https://oss.cloakbin.com

Would love feedback on the SvelteKit structure, mainly whether keeping the crypto in a client load is the cleanest pattern or if there is a more idiomatic way.

Sharing this here for the threat model rather than as a "check out my app" post, because the interesting part is what the server is architecturally prevented from seeing.

Most "send a file" services are a trust-me box: you upload plaintext (or "encrypted, but we hold the keys") to someone's bucket and hope. Warp is built so the operator cannot be a meaningful adversary:

• The only server component is a WebSocket signaling worker. It brokers the SDP/ICE handshake to introduce two peers, then steps out. No file byte ever transits it. You can watch the network tab: the transfer traffic goes peer-to-peer, not to my origin.
• The actual transfer rides the WebRTC data channel, which is DTLS-encrypted end to end. Keys are generated in-browser and never leave the two endpoints. Your ISP, the coffee-shop AP doing a MITM, and the signaling server all see ciphertext only.
• No account, no stored file, no cloud bucket. Nothing at rest to subpoena, leak, or expire.

Honest limitations, since this crowd will (correctly) poke at them:

• No TURN relay by design. If both peers are behind symmetric NATs and STUN can't establish a path, it fails with a real error instead of silently relaying through a server. That keeps the "server never sees bytes" guarantee true, at the cost of some hostile-NAT pairs not connecting. Same-LAN and most NAT combos punch through fine.
• Trust still rests on the client you're served. It's open source (MIT) and you can self-host the whole thing (static frontend + a free Cloudflare Worker), so you can verify the code that runs and pin it yourself.
• Signaling metadata (that peer A and peer B connected, when, and their IPs during ICE) is visible to the signaling server, like any WebRTC app. It's the file contents that stay private, not the fact a session happened.

Repo + protocol write-up: https://github.com/Ishannaik/warp Threat-model / how-it-works deep dive (NAT, STUN, DTLS, chunking, and why a truly-free relay is impossible): https://warp.ishannaik.com/how

Interested in where you'd attack this. The signaling worker and the ICE path are the obvious surface.

Every "send a big file" tool I tried either uploads to some cloud, caps the size, wants an account, or quietly charges you once the file is big enough. So I built the opposite.

Warp opens a room, gives you a short code (or a QR), and once the other device joins, your files stream browser-to-browser over an encrypted WebRTC channel. The server only introduces the two peers, then steps aside. It never sees, stores, or relays a single byte. No upload, no account, no size cap.

A few things I'm happy with:

• End-to-end encrypted by default (DTLS on the WebRTC data channel, keys live only in the two browsers).
• Multi-GB files stream straight to disk instead of buffering in RAM.
• True multi-device: a room is a mesh, so you can fan one file out to every device at once.
• Runs on Cloudflare's free tier + public STUN, so there's literally no paid relay that could ever bill me. $0, no card.

The one honest tradeoff: no TURN relay. If both peers are behind strict/symmetric NATs and can't punch through, Warp shows a real error instead of silently paying to relay your bytes. Same Wi-Fi always works, most networks connect fine via STUN.

Live: https://warp.ishannaik.com Code (MIT): https://github.com/Ishannaik/warp

Would love feedback, especially on the transfer UX and any network where it fails to connect.

Every time you paste an API key, DB URL, .env file, or (worst case) a crypto wallet seed phrase into Codex, Cursor, Claude Code, Cline, Aider, etc., it gets written to a local history file in plaintext.

And it doesn't just sit there — these agents re-read their own history as context, so that plaintext key keeps getting fed back to the model and can resurface in a later file, command, or reply. Most people never even look.

agentsweep is an open-source CLI that:

• Scans those history files with ~191 secret-detection rules (ported from gitleaks) plus a dedicated BIP-39 seed-phrase detector

• Supports ~30 agents out of the box (Codex, Cursor, Claude Code, Cline, Aider, Windsurf, and more)

• Redacts in place with atomic writes, .bak backups, post-write validation, and a full undo

Read-only by default; nothing destructive happens without a typed confirmation, and every redaction is reversible.

Install: pipx install agentsweep (then run: agentsweep)

Disclosure: I'm the author. It's free and MIT-licensed (not selling anything). Repo: https://github.com/Ishannaik/agent-sweep

Happy to answer questions or take PRs for more agents.

Every time you paste an API key, DB URL, .env file, or (worst case) a crypto wallet seed phrase into Codex, Cursor, Claude Code, Cline, Aider, etc., it gets written to a local history file in plaintext.

And it doesn't just sit there — these agents re-read their own history as context, so that plaintext key keeps getting fed back to the model and can resurface in a later file, command, or reply. Most people never even look.

agentsweep is an open-source CLI that:

• Scans those history files with ~191 secret-detection rules (ported from gitleaks) plus a dedicated BIP-39 seed-phrase detector

• Supports ~30 agents out of the box (Codex, Cursor, Claude Code, Cline, Aider, Windsurf, and more)

• Redacts in place with atomic writes, .bak backups, post-write validation, and a full undo

Read-only by default; nothing destructive happens without a typed confirmation, and every redaction is reversible.

Install: pipx install agentsweep (then run: agentsweep)

Disclosure: I'm the author. It's free and MIT-licensed (not selling anything). Repo: https://github.com/Ishannaik/agent-sweep

Happy to answer questions or take PRs for more agents.

The problem

Claude Code stores your full conversation history as plaintext JSONL under ~/.claude/projects/. Every API key, DB password, and .env file you've ever pasted into a chat is sitting there in plain text. A single compromised npm package running postinstall can scan common paths and exfiltrate everything in one request.

I reviewed my own history and found 3 AWS keys and a Stripe secret key I'd forgotten about entirely.

What I built

agentsweep a CLI that scans AI agent history files and redacts secrets in place.

How it works

• 189 detection rules (AWS, GitHub PATs, Stripe, OpenAI, Anthropic, Slack, JWT, PEM keys, DB URLs with passwords, BIP-39 crypto seed phrases, and ~167 more ported from the gitleaks pack)
• Aho-Corasick keyword pre-filter before regex and fast even on large histories
• Supports 10 agents: Claude Code, Codex, OpenCode, Cursor, Windsurf, Aider, Cline, Gemini CLI, Continue, GitHub Copilot Chat
• Atomic writes + mandatory .bak backup before every change
• agentsweep undo reverts any redaction instantly
• Zero network calls it runs entirely on your machine

Install

pip install uv && uv tool install agentsweep && asweep

Interactive menu walks you through everything. Type REDACT to confirm — nothing destructive happens without an explicit confirmation.

Who is this actually for

If you use local agents (Aider + Ollama, OpenCode with a local model, etc.): Your keys never left your machine via the agent, but they're sitting in plaintext files that any process on your machine can read. A compromised npm package, a malicious VSCode extension, a stolen laptop. The local file is still an attack surface even if the network never saw it.

If you already pasted keys into cloud-backed agents (Claude Code, Cursor, etc.): Yes, the provider already received those keys, agentsweep can't undo that. But your local history is a separate, ongoing attack vector. Cleaning it up removes one more way those keys can be stolen, long after the conversation ended.

The honest framing: The best practice is to not paste production keys into any AI agent at all. This tool exists for the reality that most devs already have histories full of secrets they pasted months ago without thinking twice.

GitHub: https://github.com/Ishannaik/agent-sweep

Happy to answer questions about rule coverage, false positives, or agents I haven't added yet.

Every Claude Code session you've ever run is a JSONL transcript sitting in ~/.claude/projects/. Codex keeps them in ~/.codex/sessions/. Cursor and Windsurf dump conversation blobs into state.vscdb SQLite files. Aider drops a .aider.chat.history.md into every repo you've touched. All plaintext. All world-readable to anything running as your user.

Think about what's in there: every .env you asked for help with, every DB connection string you pasted "just to debug this one thing," every AWS key, every JWT. Stealer malware already knows this credential stealers shipped in malicious npm packages have been observed grepping exactly these paths. Your shell history gets cleaned; your agent history grows forever.

I built agentsweep to deal with mine: an open-source CLI that scans the history files of 10 agents (Claude Code, Codex, Cursor, Windsurf, Aider, Cline, Gemini CLI, OpenCode, Continue, Copilot Chat) with 189 detection rules ported from gitleaks, plus a checksum-validated BIP-39 seed phrase detector then redacts findings in place.

It's careful about it because corrupting your own history would suck: atomic writes, mandatory .bak backups, post-write JSON validation, agentsweep undo to revert everything. Zero network calls your secrets never leave the machine that's already holding them.

uv tool install agentsweep
agentsweep scan

Scan is read-only. Redaction requires you to literally type REDACT.

GitHub: https://github.com/Ishannaik/agent-sweep

Obvious caveat: redacting locally doesn't un-send anything to a cloud provider its more useful for locally hosted agents, and the real fix is rotating the keys. The tool prints rotation guidance per finding for exactly that reason.

The problem

Open Code stores your full conversation history as plaintext JSONL. Every API key, DB password, and .env file you've ever pasted into a chat is sitting there in plain text. A single compromised npm package running postinstall can scan common paths and exfiltrate everything in one request.

I reviewed my own history and found 3 AWS keys and a Stripe secret key I'd forgotten about entirely.

What I built

agentsweep a CLI that scans AI agent history files and redacts secrets in place.

How it works

• 189 detection rules (AWS, GitHub PATs, Stripe, OpenAI, Anthropic, Slack, JWT, PEM keys, DB URLs with passwords, BIP-39 crypto seed phrases, and ~167 more ported from the gitleaks pack)
• Aho-Corasick keyword pre-filter before regex and fast even on large histories
• Supports 10 agents: Claude Code, Codex, OpenCode, Cursor, Windsurf, Aider, Cline, Gemini CLI, Continue, GitHub Copilot Chat
• Atomic writes + mandatory .bak backup before every change
• agentsweep undo reverts any redaction instantly
• Zero network calls it runs entirely on your machine

Install

pip install uv && uv tool install agentsweep && asweep

Interactive menu walks you through everything. Type REDACT to confirm — nothing destructive happens without an explicit confirmation.

Who is this actually for

If you use local agents (Aider + Ollama, OpenCode with a local model, etc.): Your keys never left your machine via the agent, but they're sitting in plaintext files that any process on your machine can read. A compromised npm package, a malicious VSCode extension, a stolen laptop. The local file is still an attack surface even if the network never saw it.

If you already pasted keys into cloud-backed agents (Claude Code, Cursor, etc.): Yes, the provider already received those keys, agentsweep can't undo that. But your local history is a separate, ongoing attack vector. Cleaning it up removes one more way those keys can be stolen, long after the conversation ended.

The honest framing: The best practice is to not paste production keys into any AI agent at all. This tool exists for the reality that most devs already have histories full of secrets they pasted months ago without thinking twice.

GitHub: https://github.com/Ishannaik/agent-sweep

Happy to answer questions about rule coverage, false positives, or agents I haven't added yet.

The problem

Claude Code stores your full conversation history as plaintext JSONL under ~/.claude/projects/. Every API key, DB password, and .env file you've ever pasted into a chat is sitting there in plain text. A single compromised npm package running postinstall can scan common paths and exfiltrate everything in one request.

I reviewed my own history and found 3 AWS keys and a Stripe secret key I'd forgotten about entirely.

What I built

agentsweep a CLI that scans AI agent history files and redacts secrets in place.

How it works

• 189 detection rules (AWS, GitHub PATs, Stripe, OpenAI, Anthropic, Slack, JWT, PEM keys, DB URLs with passwords, BIP-39 crypto seed phrases, and ~167 more ported from the gitleaks pack)
• Aho-Corasick keyword pre-filter before regex and fast even on large histories
• Supports 10 agents: Claude Code, Codex, OpenCode, Cursor, Windsurf, Aider, Cline, Gemini CLI, Continue, GitHub Copilot Chat
• Atomic writes + mandatory .bak backup before every change
• agentsweep undo reverts any redaction instantly
• Zero network calls it runs entirely on your machine

Install

pip install uv && uv tool install agentsweep && asweep

Interactive menu walks you through everything. Type REDACT to confirm — nothing destructive happens without an explicit confirmation.

Who is this actually for

If you use local agents (Aider + Ollama, OpenCode with a local model, etc.): Your keys never left your machine via the agent, but they're sitting in plaintext files that any process on your machine can read. A compromised npm package, a malicious VSCode extension, a stolen laptop. The local file is still an attack surface even if the network never saw it.

If you already pasted keys into cloud-backed agents (Claude Code, Cursor, etc.): Yes, the provider already received those keys, agentsweep can't undo that. But your local history is a separate, ongoing attack vector. Cleaning it up removes one more way those keys can be stolen, long after the conversation ended.

The honest framing: The best practice is to not paste production keys into any AI agent at all. This tool exists for the reality that most devs already have histories full of secrets they pasted months ago without thinking twice.

GitHub: https://github.com/Ishannaik/agent-sweep

Happy to answer questions about rule coverage, false positives, or agents I haven't added yet.