I discovered that an AI coding CLI had stored hundreds of session files under the user profile: 787 JSONL files totaling about 1.1 GB, with one project accounting for most of the space. Each file contains the conversation, tool calls, tool results, and command output, so it can include anything that was pasted into a prompt or returned by a command.
That means credentials, connection strings, authorization headers, environment-file contents, and other sensitive data may remain in plaintext on the endpoint and potentially in profile backups. The logs are also retained long enough to matter if an account or device is compromised. The tool appears to clean up sessions after a configurable retention period, with 30 days as the default, but that still leaves a substantial exposure window.
For a managed fleet, would you treat these directories as sensitive data and include them in encryption, DLP, backup, and retention policies? Or is the better approach to prevent secrets from reaching the agent in the first place, use short-lived credentials, and rely on endpoint encryption and access controls for the remaining logs?
4 Answers
These files should be treated as sensitive development data. Use full-disk encryption, restrict local access, include the directory in endpoint monitoring and DLP decisions, and decide explicitly whether it belongs in backups. Also document the retention period instead of assuming the default is appropriate for every environment.
Session transcripts are normal for tools that support resuming work, and the storage size alone is not necessarily a defect. The important points are knowing exactly what is recorded, setting a short retention period, verifying the cleanup behavior, excluding or protecting the data in backups, and teaching developers never to paste credentials into prompts or command output.
A user profile directory is normally only readable by that user, so the risk is not automatically that every employee can browse everyone else's transcripts. The bigger concerns are local administrators, malware, privilege escalation, backups, forensic collection, and devices that are not properly retired or wiped. Disk encryption and standard offboarding procedures still matter.
Right, and a local admin or a compromised account can often bypass ordinary file permissions. Access control reduces exposure, but it should not be treated as protection against endpoint compromise.
The main fix is to keep secrets out of the agent context entirely. Inject credentials at runtime from a secret manager, use short-lived tokens, and rotate anything that may have appeared in a transcript. Backup exclusions and log deletion are useful second layers, but they do not undo a credential that was already exposed.
Exactly. If a token has already been pasted or printed in command output, treat it as compromised and revoke it. The log-retention policy is not a substitute for secret-management hygiene.
Some enterprise deployments combine the vendor's administration and compliance controls with network DLP and endpoint protection. It is not perfect, especially for local JSON files, but it provides visibility into who is using approved tools and helps enforce training and policy.