/01
.env file found in git commit history
critical
project#demo
Category
Git Posture
Evidence count
1 row
Reference
evidence/git-posture.json
5 coding agents are in use on the endpoint. 3 critical findings need action this week.
| Tool | Status | Duration | Collector |
|---|---|---|---|
| Claude Code | detected | - | 1.0.0 |
| Cursor | detected | - | 1.0.0 |
| Codex Desktop | detected | - | 1.0.0 |
| GitHub Copilot | detected | - | 1.0.0 |
| Grok Build | detected | - | 1.0.0 |
Claude Code, Cursor, Codex Desktop, GitHub Copilot and Grok Build are in active use. The items below represent durable secret exposure, persistent permission state with no prompt, and runtime configuration that bypasses sandboxing.
project#demo
Git Posture
1 row
evidence/git-posture.json
sandbox=disabled
Shell Execution
1 row
evidence/codex.json
permission_mode=always-approve yolo=true
Shell Execution
1 row
evidence/grok.json
Detected tools, highest observed risk, and permission, approval, and activity counts, side by side.
| Platform | Detected | Highest-risk | MCP rules | Stored allow rules | Approval evidence | Chat msgs | Active est. |
|---|---|---|---|---|---|---|---|
| Claude Code | yes | critical | 1 | 1 | available via OTEL | 3 files | - |
| Codex Desktop | yes | critical | 0 | 1 | - | 2 files | - |
| Grok Build | yes | critical | 1 | 0 | bypassed | 1 files | - |
| Cursor | yes | none | 0 | 0 | - | 6 files | - |
| GitHub Copilot | yes | none | 0 | 0 | - | - | - |
Stored allow rules are durable non-MCP permission entries. Approval evidence shows recorded prompt decisions when available. For Claude Code, local transcripts do not reliably distinguish a user-click accept from config, mode, or always-allow behavior; use OTEL tool_decision telemetry for click/source attribution. Secrets scan total: 1 hits across 3 targets; reported under Findings / Secrets Exposure.
Tabs are exposure categories. Use the filter to search across titles, samples, and tags. Per-hit secrets are grouped — full per-row evidence is in the appendix.
| Severity | Title | Evidence | Last seen | Sample |
|---|---|---|---|---|
| critical | Codex sandbox bypass observed | 1 | n/a | sandbox=disabled |
| critical | Grok Build permission_mode is always-approve | 1 | n/a | permission_mode=always-approve yolo=true |
| high | Claude dangerous-mode confirmation prompt is disabled | 1 | n/a | skipDangerousModePermissionPrompt=true |
| Severity | Title | Evidence | Last seen | Sample |
|---|---|---|---|---|
| high | Potential secret in chat export | 1 | n/a | ghp_**** |
| medium | Secret-like value observed in chat export | 1 | n/a | ghp_****REDACTED**** |
| Severity | Title | Evidence | Last seen | Sample |
|---|---|---|---|---|
| critical | .env file found in git commit history | 1 | n/a | project#demo |
Settings-derived allow rules, MCP registrations, and observed approval decisions grouped by platform.
| Server | Scope | Evidence | Source |
|---|---|---|---|
playwright | user#abc123 | server registered | - |
*The MCP table lists registrations from mcp.json plus project approvals. Known (runtime) counts servers Cursor has seen in state.vscdb; unmatched known servers have no local mcp.json row. Local state cannot reconstruct every clicked approval as a reusable command allow-list.
prefix:demoInventory from config.toml, session summary/signals, and events.jsonl MCP resolution. Chat history and updates.jsonl content stay out of evidence. always-approve / yolo means tool use is not prompted.
| Server | Scope | Evidence | Source |
|---|---|---|---|
demo | user#mcp1 | server registered | - |
Transcript text stays in raw/. Only counts and retention metadata land here. The 90-day mark is the stated policy.
| Tool | Oldest | Newest | Files | Active estimate | Secret-hit files | Retention |
|---|---|---|---|---|---|---|
| claude | n/a | n/a | 3 | 0m | 0 | 45d |
| codex | n/a | n/a | 2 | 0m | 0 | 45d |
| cursor | n/a | n/a | 4 | 0m | 0 | 45d |
| cursor-composer | n/a | n/a | 2 | 0m | 0 | 45d |
| grok | n/a | n/a | 1 | 0m | 0 | 45d |
Active time is a capped-gap estimate from transcript timestamps: gaps between consecutive messages in the same session count up to 30 minutes. It is directional, not a timesheet, and tools with coarse timestamps may undercount.
gitleaks scans chat exports and repo roots for credential-shaped strings; samples are redacted and full hits stay in raw/secrets-scan/findings.csv. Git posture checks local repos for .env in history, hook presence, .gitignore coverage, and large blobs.
No rule breakdown recorded.
// by location · chat: 0 · repos: 1
// scanner: gitleaks
Collectors read local endpoint state and wrote evidence into this output directory. Raw evidence remains local; anything you share should follow the evidence contract in SCHEMA.md.
8 collectors produced local evidence. Collector versions and completion times are in Methodology.
| Collector | Status | Evidence volume |
|---|---|---|
| Claude Code | collected | 2 permission rules |
| Cursor | collected | local state found |
| Codex Desktop | collected | 1 permission rules |
| GitHub Copilot | collected | settings found |
| Grok Build | collected | 1 permission rules |
| Chat History | collected | 340 chat messages |
| Secrets Scan | collected | 1 secret hits |
| Git Posture | collected | 5 git repos |
| Collector | Work performed | Completed at | Duration | Version | Status |
|---|---|---|---|---|---|
| Chat transcripts chat-history | Transcript export across detected AI tools | 2026-07-11 21:23:58 +0000 | not recorded | 1.0.0 | ok |
| Claude posture claude | Claude settings, permissions, and MCP posture | 2026-07-11 21:23:58 +0000 | not recorded | 1.0.0 | ok |
| Codex posture codex | Codex config, trusted projects, and MCP posture | 2026-07-11 21:23:58 +0000 | not recorded | 1.0.0 | ok |
| GitHub Copilot posture copilot | Copilot local settings detection | 2026-07-11 21:23:58 +0000 | not recorded | 1.0.0 | ok |
| Cursor posture cursor | Cursor local state, durable rules, and approval events | 2026-07-11 21:23:58 +0000 | not recorded | 1.0.0 | ok |
| Discovery discovery | Local tool path and capability discovery | 2026-07-11 21:23:58 +0000 | not recorded | 1.0.0 | ok |
| Git posture git-posture | Local repository hygiene checks | 2026-07-11 21:23:58 +0000 | not recorded | 1.0.0 | ok |
| Grok posture grok | Grok config and session posture | 2026-07-11 21:23:58 +0000 | not recorded | 1.0.0 | ok |
| Secrets scan secrets-scan | gitleaks scan over chat exports and repo roots | 2026-07-11 21:23:58 +0000 | not recorded | 1.0.0 | ok |
Manifest SHA-256 (first 16 chars · full hashes in bundled manifest): manifest not pre
Raw evidence remains in the local output directory; shareable bundles should be sanitized per SCHEMA.md.
Per-hit gitleaks rows are aggregated by rule type. Identical findings collapse into a single row with a hit count; full per-row detail lives in the linked CSV.
| Severity | Finding | Hits | Evidence reference |
|---|---|---|---|
| critical | .env file found in git commit history | 1 | evidence/git-posture.json |
| critical | Codex sandbox bypass observed | 1 | evidence/codex.json |
| critical | Grok Build permission_mode is always-approve | 1 | evidence/grok.json |
| high | Claude dangerous-mode confirmation prompt is disabled | 1 | evidence/claude.json |
| high | Potential secret in chat export | 1 | evidence/secrets-scan.json |
| medium | Secret-like value observed in chat export | 1 | evidence/chat-history.json |