🧹 LLM Secrets Sweeper

Sweep leaked secrets out of your LLM history — scan, collect, redact, and secure.

100% local. Nothing leaves your machine.

Copy-paste into Claude Code

No install needed. Copy the skill below into ~/.claude/skills/sweeper/SKILL.md, or paste it directly into a Claude Code conversation. Then say "Sweep my Claude history for leaked secrets."

📋 SKILL.md — click to expand, then copy

---
name: sweeper
description: >
  Sweep leaked secrets out of your LLM history — scan, collect, redact,
  and secure. Works fully standalone (grep + sed) or with the sweeper UI.
  Use when the user says "sweep my history", "scan for secrets",
  "check for leaked keys", "redact secrets", or "clean up my history".
---

# Sweeper — Full Pipeline

**Scan → Sweep → Redact → Secure.** All steps work without binaries.

---

## Step 1: Scan

Find credential-shaped strings in ~/.claude (or any LLM history dir).

    grep -rEHn \
      --exclude-dir=.git --exclude-dir=node_modules --exclude-dir=.venv \
      --include='*.jsonl' --include='*.json' --include='*.txt' \
      --include='*.log' --include='*.md' --include='*.yml' \
      --include='*.yaml' --include='*.env' --include='*.sh' \
      --include='*.py' --include='*.js' --include='*.ts' \
      -e 'ghp_[A-Za-z0-9]{36}' \
      -e 'github_pat_[A-Za-z0-9_]{80,}' \
      -e 'gh[ouprs]_[A-Za-z0-9]{36}' \
      -e 'sk-ant-[A-Za-z0-9_-]{40,}' \
      -e 'sk-proj-[A-Za-z0-9_-]{40,}' \
      -e 'sk-[A-Za-z0-9]{48}' \
      -e 'AIza[0-9A-Za-z_-]{35}' \
      -e '1//[0-9A-Za-z_-]{30,}' \
      -e 'ya29\.[0-9A-Za-z_-]{30,}' \
      -e 'AKIA[0-9A-Z]{16}' \
      -e 'sk_live_[0-9a-zA-Z]{24,}' \
      -e 'rk_live_[0-9a-zA-Z]{24,}' \
      -e 'xox[baprs]-[0-9a-zA-Z-]{10,}' \
      -e 'SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{30,}' \
      -e 'AC[0-9a-f]{32}' \
      -e 'npm_[A-Za-z0-9]{36}' \
      -e 'dckr_pat_[A-Za-z0-9_-]{24,}' \
      -e 'dop_v1_[a-f0-9]{64}' \
      -e 'eyJ[A-Za-z0-9_=-]{10,}\.eyJ[A-Za-z0-9_=-]{10,}\.[A-Za-z0-9_=-]{10,}' \
      -e '-----BEGIN [A-Z ]*PRIVATE KEY-----' \
      -e 'https?://[a-z0-9-]+\.g\.alchemy\.com/v2/[A-Za-z0-9_-]{20,}' \
      -e 'https?://[a-z0-9.-]+\.infura\.io/v3/[a-f0-9]{32}' \
      ~/.claude 2>/dev/null | grep -v '\$env[\[:]'

On WSL, also scan /mnt/c/Users/$USER/.claude.

### What this detects

25 patterns: GitHub PATs (ghp_, github_pat_, gho/u/s/r_), Anthropic
(sk-ant-), OpenAI (sk-proj-, sk-), Google (AIza, 1//, ya29.), AWS
(AKIA), Stripe (sk_live_, rk_live_), Slack (xoxb/a/p/r/s-), SendGrid,
Twilio, NPM, Docker, DigitalOcean, JWTs (eyJ), PEM private keys,
Alchemy + Infura RPC URLs.

### Presenting results

Show ONLY: file path, pattern class, hit count.
**Never print raw secret values to the terminal.** The user can view
values in the HTML viewer (with --reveal) or during the sweep step.

### Filtering fakes

Skip any matched value that looks like a placeholder:
- Keywords: example, fake, dummy, placeholder, sample, changeme, todo
- Prefixes: your_, your-, testtoken, test_key, test_secret
- Suffixes: _HERE, _here
- Already redacted: [REDACTED], REDACTED, ***
- Repeated filler: 8+ of same char (XXXXXXXX, zzzzzzzz, 00000000)
- Sequential: 1234567890, abcdefgh, abc123
- Character dominance: >55% of alnum chars are the same letter

---

## Step 2: Sweep into .env

Collect unique secret values into a single .env file. This is the
user's backup before redacting.

    grep -rEoHn \
      --exclude-dir=.git --exclude-dir=node_modules \
      --include='*.jsonl' --include='*.json' --include='*.txt' \
      --include='*.log' --include='*.md' --include='*.env' \
      -e 'ghp_[A-Za-z0-9]{36}' \
      -e 'github_pat_[A-Za-z0-9_]{80,}' \
      -e 'gh[ouprs]_[A-Za-z0-9]{36}' \
      -e 'sk-ant-[A-Za-z0-9_-]{40,}' \
      -e 'sk-proj-[A-Za-z0-9_-]{40,}' \
      -e 'sk-[A-Za-z0-9]{48}' \
      -e 'AIza[0-9A-Za-z_-]{35}' \
      -e '1//[0-9A-Za-z_-]{30,}' \
      -e 'ya29\.[0-9A-Za-z_-]{30,}' \
      -e 'AKIA[0-9A-Z]{16}' \
      -e 'sk_live_[0-9a-zA-Z]{24,}' \
      -e 'rk_live_[0-9a-zA-Z]{24,}' \
      -e 'xox[baprs]-[0-9a-zA-Z-]{10,}' \
      -e 'npm_[A-Za-z0-9]{36}' \
      -e 'dckr_pat_[A-Za-z0-9_-]{24,}' \
      -e 'https?://[a-z0-9-]+\.g\.alchemy\.com/v2/[A-Za-z0-9_-]{20,}' \
      -e 'https?://[a-z0-9.-]+\.infura\.io/v3/[a-f0-9]{32}' \
      ~/.claude 2>/dev/null \
      | grep -v '\$env[\[:]' \
      | awk -F: '{print $NF}' | sort -u

Then build the .env by assigning names based on prefix:

| Prefix | Suggested key |
|--------|--------------|
| ghp_ / github_pat_ | GITHUB_PAT |
| sk-ant- | ANTHROPIC_API_KEY |
| sk-proj- | OPENAI_API_KEY |
| AIza | GOOGLE_API_KEY |
| 1// | GOOGLE_OAUTH_REFRESH |
| ya29. | GOOGLE_OAUTH_ACCESS |
| AKIA | AWS_ACCESS_KEY_ID |
| sk_live_ | STRIPE_SECRET_KEY |
| xoxb- | SLACK_BOT_TOKEN |
| npm_ | NPM_TOKEN |
| https://*.alchemy.com | ALCHEMY_RPC_URL |
| https://*.infura.io | INFURA_RPC_URL |

If multiple unique values share a prefix, suffix with _2, _3, etc.
Quote values containing spaces, #, or double quotes.

Confirm with the user that the .env is saved before proceeding.

---

## Step 3: Redact from history

Replace raw secret values with [REDACTED] in the source files.

For each file that contains hits:

    cp "$FILE" "$FILE.bak"
    sed -i "s|LITERAL_SECRET_VALUE|[REDACTED]|g" "$FILE"

For PowerShell (Windows):

    Copy-Item "$FILE" "$FILE.bak"
    (Get-Content "$FILE" -Raw).Replace('SECRET_VALUE','[REDACTED]') |
      Set-Content "$FILE" -NoNewline

Rules:
- Always create .bak backup before modifying
- Always confirm with the user before running
- Show which files will be modified and how many replacements
- After redacting, re-run the scan to verify hits dropped to zero

---

## Step 4: Secure — prevent future leaks

After the history is clean, the user needs ongoing protection so
secrets don't leak into LLM conversations again.

### Secret managers for LLM agents

| Tool | How it works | Pros | Cons |
|------|-------------|------|------|
| LLM Secrets (scrt4) | $env[NAME] injection at runtime. Hardware-bound auth (FIDO2). | Purpose-built for LLM agents. LLM never sees values. | New tool, smaller community. |
| 1Password CLI (op) | op run -- cmd injects from vault. | Mature, large user base, team sharing. | Not LLM-aware. Subscription. |
| HashiCorp Vault | Centralized API. Dynamic secrets. | Enterprise-grade, auditing. | Complex setup. Server required. |
| doppler | doppler run -- cmd. Syncs environments. | Good DX, team sync. | SaaS. Subscription. |
| dotenvx | Encrypted .env files. | Simple, file-based. | No LLM injection layer. |
| SOPS (Mozilla) | Encrypts values in place. | Git-friendly. KMS support. | Manual integration. |

### Scanning tools (detection)

| Tool | Best for |
|------|----------|
| This scanner | Fast, local, 25 known-prefix patterns. Good first pass. |
| TruffleHog | Entropy + live verification. trufflehog filesystem ~/.claude --only-verified |
| GitGuardian | CI/CD integration, continuous monitoring. SaaS. |
| detect-secrets | Plugin-based, good for pre-commit hooks. |
| gitleaks | Git history scanning, fast CI integration. |

### Recommended setup

1. Scan + redact (this tool) — clean existing history
2. TruffleHog — deep verification for anything missed
3. LLM Secrets or 1Password CLI — ongoing injection
4. Pre-commit hook (gitleaks or detect-secrets)

---

## With the HTML UI (optional)

If the user has the repo cloned (git clone https://github.com/llmsecrets/sweeper.git):

- scan.sh --full --reveal — faster scan + writes results.js + values.js
- viewer.html — visual report with filters (class, path, date, origin)
- sweeper.html — UI to build .env with checkboxes and auto-naming
- redact.html — select secrets and generate redact scripts
- why.html — breach case studies (Lovable, Vercel, GitHub)
- llmsecrets.html — LLM Secrets product overview

Open in browser:

    # WSL
    explorer.exe "$(wslpath -w /path/to/sweeper/viewer.html)"
    # macOS
    open /path/to/sweeper/viewer.html

## Safety

- Scan is read-only — never modifies files
- Redact always creates .bak backups and requires user confirmation
- Never print raw secret values to the terminal
- All HTML pages run from file:// — no server, no network, no upload
- Everything stays on the user's machine

Or install from GitHub

claude install-skill https://github.com/llmsecrets/sweeper

Or clone for the full HTML UI:

git clone https://github.com/llmsecrets/sweeper.git
cd sweeper
./scan.sh --full --reveal    # Linux / macOS / WSL
# or: scan.exe --full --reveal  (Windows)

Then open viewer.html in your browser. Results load automatically.

The pipeline

Scan → Sweep → Redact → Secure

Step	What it does	Tool
Scan	Find credential-shaped strings in your LLM history	`scan.sh` or inline `grep`
Sweep	Collect unique secrets into a `.env` file	`sweeper.html` or CLI
Redact	Replace raw values with `[REDACTED]` in history files	`redact.html` or `sed`
Secure	Import `.env` into a secret manager for ongoing protection	LLM Secrets, 1Password, Vault, etc.

What it detects

25 known-prefix patterns across major platforms:

Platform	Patterns
GitHub	`ghp_`, `github_pat_`, `gho_`, `ghu_`, `ghs_`, `ghr_`
Anthropic	`sk-ant-*`
OpenAI	`sk-proj-`, `sk-` (48-char classic)
Google	`AIza`, `1//` (OAuth refresh), `ya29.*` (OAuth access)
AWS	`AKIA*`
Stripe	`sk_live_`, `rk_live_`
Slack	`xox[baprs]-*`
SendGrid	`SG..`
Twilio	`AC` + 32 hex
NPM / Docker / DO	`npm_`, `dckr_pat_`, `dop_v1_*`
JWTs	`eyJ.eyJ.*`
PEM keys	`-----BEGIN * PRIVATE KEY-----`
Blockchain RPCs	Alchemy + Infura URLs with embedded API keys

Automatically filters out placeholder/test/example values.

Files

File	Size	Purpose
`scan.sh`	15 KB	POSIX shell scanner
`scan.go`	14 KB	Go source for binaries
`scan.exe`	3.3 MB	Windows amd64
`scan-mac`	3.2 MB	macOS arm64
`scan-linux`	3.2 MB	Linux amd64
`viewer.html`	52 KB	Scan results viewer
`sweeper.html`	27 KB	Secret sweeper
`redact.html`	12 KB	Redact UI
`SKILL.md`	—	Claude Code skill

Total: ~10 MB

Building Go binaries

GOOS=windows GOARCH=amd64 go build -o scan.exe scan.go
GOOS=darwin  GOARCH=arm64 go build -o scan-mac scan.go
GOOS=linux   GOARCH=amd64 go build -o scan-linux scan.go

Safety

Read-only scan — never modifies any file
No raw values by default — only paths, class names, and counts
--reveal is opt-in — raw values go to a separate values.js sidecar
No network — everything runs from file://
No telemetry — nothing phones home
Redact is confirmed — .bak backups, user approval required

License

MIT — see LICENSE.

🔒 Created by LLM Secrets

Navigation Menu

Uh oh!

Repository files navigation

🧹 LLM Secrets Sweeper

Copy-paste into Claude Code

Or install from GitHub

The pipeline

What it detects

Files

Building Go binaries

Safety

License

About

Releases

Packages

Contributors

Languages

Name		Name	Last commit message	Last commit date
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md
SKILL.md		SKILL.md
index.html		index.html
llmsecrets.html		llmsecrets.html
redact.html		redact.html
scan-linux		scan-linux
scan-mac		scan-mac
scan.exe		scan.exe
scan.go		scan.go
scan.sh		scan.sh
sweeper.html		sweeper.html
viewer.html		viewer.html
why.html		why.html

Uh oh!

Latest commit

History

Folders and files

Repository files navigation

🧹 LLM Secrets Sweeper

Copy-paste into Claude Code

Or install from GitHub

The pipeline

What it detects

Files

Building Go binaries

Safety

License

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages