Did Your AI Coding Agent Leak Your API Keys? How Stroq Checks, and Where It Stops

Your AI coding agent reads files, runs commands and calls the network for you, and those sessions are recorded on your machine. If a key from your .env file showed up in one of them, would you know? Stroq is a free, open-source tool that checks. Its new version, 0.30.0, came out on November 5, 2026, the same day it was posted to Hacker News as a Show HN, and it adds a one-command summary card.

What's new in 0.30.0: the card

Run npx @stroq/cli with no command and Stroq reads the last 30 days of Claude Code and Codex sessions on your machine, replays them through its policy in a throwaway home (nothing runs, nothing is sent), and prints plain counts:

• the commands your agent ran
• how many of them came from text it read (a README, page, issue or tool result)
• the keys that left your machine
• the repositories that run code as soon as an agent opens them

Under the counts it lists the few moments worth a look, and stroq show N prints the call behind each one, with every traced key replaced by its name. It prints key names, never values, and writes only a small cache under ~/.stroq. The project says the first run on a machine with about 2,000 sessions took about 30 seconds, and the next about 4. The release also added a rule for instructions slipped into data the agent reads, and cut the main help down to five commands.

Where each key went: stroq sent

For the detail, the older stroq sent command reads your Claude Code, Codex CLI and Cursor sessions and compares them with the credentials stored on your machine: ~/.aws/credentials, ~/.npmrc, ~/.netrc, ~/.docker/config.json, the .env files of each folder a session ran in and of the folders above it up to the repository root, and credential-named environment variables. For each key it finds, it says what it saw:

• Sent to another company: a call carried the key to a host that isn't the key's own service.
• Maybe sent: a program ran with it, a file it was written to was later sent or run, or Stroq couldn't read all of what carried it.
• Seen by the AI: your agent's model saw it, in an output, a prompt, a reply or a read-only command.
• Used with its own service: only on strict proof, such as an OpenAI key in the auth header of a plain request to api.openai.com.
• Blocked before it ran: Claude Code recorded the call as refused or blocked (a Codex or Cursor log saying a call was stopped doesn't count).

It prints the key's name and where it came from, never the value. It runs locally, needs no account, has no telemetry and sends nothing.

Try it

1. Check you have Node.js 22 or newer.
2. Run the card: npx @stroq/cli (npx downloads the package on first run).
3. See what a detailed key report looks like, with a made-up key: npx @stroq/cli sent --try. It reads no file on your machine and writes nothing.
4. Scan your own sessions: npx @stroq/cli sent. Add --here for just the project you're in.
5. Rotate any key it lists as sent to another company, and decide about the ones it lists as seen by the AI.
6. Guard the next session: npx @stroq/cli init adds Stroq's hooks to your agent, so an outbound call that carries a known key can be denied before it runs.

The catch

Stroq is clear about its limits, and they matter:

• It only names a send it can see in the command. Stroq names a send only when it sees the key in the command that sent it. A script, a file or a variable can carry a key out without showing it, so a milder result only means Stroq didn't see a send.
• Known keys only. It compares against the keys on your machine today. A key you rotated or deleted since can't match, and split or encoded values can be missed.
• It can't see the provider's side. A local transcript can't prove which bytes a model provider received or kept.
• The hooks are a filter. In its own README's words, it is "a filter, not a sandbox."

It's also a young project, so read the integration limits before you rely on a live hook.

Here's how you get paid

My opinion, no income guaranteed: if a small dev team runs coding agents, it may not have checked what those agents saw. Offer one team a key-leak audit:

1. Scan. Run the session scan on each developer's machine, with their permission, and keep the report (names and sources only).
2. Rotate. Rotate every key it lists as sent to another company, and agree with the team which "seen by the AI" keys to rotate too.
3. Guard. Set up the hooks on each agent, and check that each agent actually calls them.

Tell them up front what the scan can't see, so the audit is honest about its limits.