# Shell history leak

Canonical page: /glossary/shell-history-leak

API keys & secrets glossary, Mistakes & leaks. Shell History Leak: The Secret Hiding in .zsh_history

**Short answer:** A shell history leak happens when a secret is typed directly as part of a terminal command, for example export ANTHROPIC_API_KEY=sk-ant-..., and your shell saves that entire line, value included, to a history file like .zsh_history, in plain text, indefinitely.

## Why it matters

Shell history is rarely encrypted and is often backed up along with the rest of your home folder, so a key typed into a command months ago can still be sitting there, readable, long after you've forgotten about it.

## In Claude Keychain

Because Claude Keychain adds a key through its own app interface rather than a terminal command, the value never has to be typed on a command line, so it never ends up in your shell history in the first place.

## Common questions

**Can I remove a secret from my shell history after the fact?**

Yes, by editing or clearing the history file, but the safest response to an exposed key is still to revoke and replace it.

**Does this only affect zsh?**

No, every common shell, bash included, keeps a similar history file with the same risk.

## Related

[Environment variable](/glossary/environment-variable), [Hardcoded secret](/glossary/hardcoded-secret), [.env file](/glossary/env-file)