Shell history leak
A shell history leak happens when a secret is typed directly as part of a terminal command, for example export ANTHROPIC_API_KEY=sk-ant-..., and your shell saves that entire line, value included, to a history file like .zsh_history, in plain text, indefinitely.
Why it matters
Shell history is rarely encrypted and is often backed up along with the rest of your home folder, so a key typed into a command months ago can still be sitting there, readable, long after you've forgotten about it.
Can I remove a secret from my shell history after the fact?
Yes, by editing or clearing the history file, but the safest response to an exposed key is still to revoke and replace it.
Does this only affect zsh?
No, every common shell, bash included, keeps a similar history file with the same risk.
Related
Looking for a different way to manage your keys? See the best Claude Code API key manager alternatives, or browse every term in the glossary.