TLDR Tech / InfoSec
ghosttype (GitHub Repo)
ghosttype is a Python 3.11+ local forensic scanner that extracts exposed credentials from AI tool conversation history across Claude Code CLI, Cursor IDE, Codex CLI, and ChatGPT Desktop. The two-layer detection engine pairs 30 high-confidence regex patterns covering AWS, GitHub PATs (6 formats), Stripe, Slack, Vault, GCP service accounts, JWTs, and PEM keys with 10 heuristic context-signal patterns, applying an entropy threshold of ≥3.0 bits/char plus placeholder filtering to suppress false positives. CLI flags include --min-confidence high, --redact, --max-age-days, --allow-list, and JSON/CSV output piping to jq.
Read the full story