v0.5.15

bordercheck full-scan (it replaces bordercheck chats, which still works) reads what the hourly check reads only in part or not at all, and lists every secret it finds, never the values:

• all of the AI chat history (Claude Code, Codex, Gemini CLI, Copilot, Cursor's agent, VS Code chat, Cline, Aider);
• the databases of tools that keep chats or a clipboard: Cursor's editor, opencode, Goose, Alfred's clipboard history;
• log files (.log in the temporary folders and ~/Library/Logs);
• the history of your own commits in every git repository the secrets walk reaches, on every branch and tag, and the stash: which commit added each secret, whether it was pushed and whether the current files still hold it. Commits by other authors, dependencies and build output committed by mistake, tools' cached repositories and made-up passwords in test and example files are left out. -no-git skips it.

It takes about a minute on a busy computer. It only reads, apart from noting the date it ran (fullscan.json in the install folder). Until it has run once, the secrets summary suggests it, and a notification nudges the person: a day after install, then every 14 days, never again once it has run. Policy: notify.first_full_scan_nudge ("24h", "0" = never), notify.full_scan_nudge_every ("336h", "0" = only once).

More places the secrets check reads (policy checks.secrets.locations):

• trash: the Trash (macOS ~/.Trash, Linux, and the Windows Recycle Bin with each file's original name): keys, .env files and SSH private keys left there stay on disk until it is emptied.
• key_files: Google service account keys saved anywhere, such as ~/Downloads.
• api_clients: Insomnia's environments and request credentials, exported Postman environments, DBeaver's saved passwords.

Each comes with its own advice. A secret in a folder synced with a cloud service (iCloud Drive, Dropbox, OneDrive, Google Drive) is marked [synced to …], with advice to delete the old versions there too.

New policy fields need v0.5.15 or later on every machine of the role when set. The Windows Recycle Bin and the full scan on Windows are covered by tests only.