v1.0.1

Changes

• Updated all dependencies to their latest versions. This clears the vulnerabilities reported in golang.org/x/crypto, github.com/ulikunitz/xz, github.com/klauspost/compress and github.com/nwaples/rardecode, all pulled in through gitleaks. govulncheck finds nothing the code calls.
• claude-scrub --version now reports the module version for builds made with go install instead of dev.
• The README covers installing a prebuilt binary or using go install.

Detection and redaction are unchanged from v1.0.0.

Install

Download the binary for your platform below, or run go install github.com/overflowy/claude-scrub@v1.0.1. checksums.txt has the SHA-256 of each file.

The macOS binaries aren't signed. If macOS blocks one, run xattr -d com.apple.quarantine on it.

v1.0.0

First release.

claude-scrub finds secrets in Claude Code's history under ~/.claude (session transcripts, prompt history, paste cache, file history, shell snapshots) and replaces each with a label such as [REDACTED:db_password].

• Runs as a dry run with --dry-run, interactively with a confirmation, or as a SessionEnd hook with --hook.
• Detects secrets from your own list, values assigned to secret-looking names, passwords in URLs and Authorization headers, and the gitleaks rules.
• A value found once is redacted everywhere it appears.
• Rewrites keep JSON lines valid and preserve each file's mode and modification time.
• Scans 1.3 GB of history in about 5 seconds on an 18-core M5 Pro.

Install

Download the binary for your platform below, or build from source with go install github.com/overflowy/claude-scrub@v1.0.0. checksums.txt has the SHA-256 of each file.

The macOS binaries aren't signed. If macOS blocks one, run xattr -d com.apple.quarantine ./claude-scrub_1.0.0_darwin_arm64.