Where Claude Code and Codex Store Session Transcripts, and How to Keep Secrets Out of Them

Claude Code and Codex can save records of coding sessions on your computer. These transcripts record the conversation and, depending on the tool and activity, details such as tool calls and their results. A JSONL file has one JSON record on each line, so a tool can write and read session events in sequence.

A transcript can include more than what you type. If an agent reads a file with credentials or a command prints a token, the value can appear in tool output and end up in a saved session record. Claude Code documents this risk directly; Codex’s local recorder confirms that it saves session records, though the exact contents can vary by version and interface.

Where the local files are stored

Claude Code stores local session transcripts under ~/.claude/projects/, with files organized by project and session. On Windows, ~ refers to your user profile directory, so the default location is %USERPROFILE%\.claude. Setting CLAUDE_CONFIG_DIR moves Claude Code’s user data to a different directory. The Claude Code directory documentation describes the layout and the data those files contain.

Codex stores local session records under a sessions directory in its home directory. Its source code calls these records rollouts. The typical path is ~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl; changing the configured Codex home changes the base directory. The Codex rollout recorder describes how Codex saves records for later inspection or replay. The directory layout and record fields depend on the implementation, so check the files created by the Codex version and interface you use.

A session transcript and a prompt-history file serve different purposes. Claude Code’s history.jsonl lets you recall and search prompts. Codex also has a separate history setting in its configuration source. Turning off or deleting one type of record does not necessarily turn off or delete the other.

How secrets get into a transcript

A secret can enter a session record in three common ways: you paste it into a prompt, the agent reads a file that contains it, or a command prints it. Pasting the secret puts it directly in the conversation. Reading a file or printing a secret exposes it through tool input or output, which the session record may save.

Claude Code’s documentation says its local transcripts are plaintext and are not encrypted at rest. It also warns that reading a .env file or printing a credential in a command can put that value in the transcript. Your operating system’s file permissions control who can access the files, but the files are not encrypted.

Codex’s recorder confirms that it saves local session events as JSONL. Available documentation does not give a complete, stable description of every field that each version or interface saves. Treat a Codex rollout as potentially sensitive. Before sharing or storing one elsewhere, inspect records from your own workflow.

An environment variable keeps a credential’s literal value out of a prompt, but code running in that environment can still access it. OpenAI’s sandbox security guidance warns that agent-generated code can read environment variables. Use environment variables for credentials only when the agent needs access, and limit what each credential allows.

How to limit exposure

Keep credentials out of prompts and instructions. Do not put them in source files or command output. For example, do not ask an agent to display a .env file or print all environment variables to diagnose a problem. Give it a task it can complete without seeing the credential. When code needs credentials, use a secret manager, which stores credentials and supplies them to code that needs them, or another runtime method that limits access.

Before starting a session, limit which files the agent can access. An isolated workspace or the product’s file access settings can keep the agent away from credential stores and unrelated private files. This reduces the chance of accidental reads, but it does not remove content after the agent has read it.

Give credentials only the permissions they need, and set them to expire as soon as practical. If a transcript, tool result, or log may contain a credential, revoke it or replace it with a new one. Then check where the record went. Look in backups and device-monitoring tools, as well as synchronized configuration files, tickets, and shared drives.

Claude Code documents controls for limiting local persistence. CLAUDE_CODE_SKIP_PROMPT_HISTORY skips writes to transcripts and prompt history. For non-interactive use, claude -p supports --no-session-persistence; the TypeScript Agent SDK provides persistSession: false. These controls apply to the modes described in the documentation. Check the interface you use rather than assuming one setting covers every Claude product.

Claude Code also documents cleanupPeriodDays, which sets when it cleans up covered local data. The default is 30 days, and the minimum is one day; Claude Code rejects a value of zero. Cleanup depends on file age, so Claude Code does not erase a transcript as soon as a session ends. A shorter retention period limits how long covered files remain, but it does not stop Claude Code from writing a secret to a transcript.

Codex’s source includes an ephemeral configuration path that disables saving session records. The source does not show that every Codex CLI or app workflow supports this as a user-facing setting. Before relying on it, check the documentation for the interface you use. The Codex documentation reviewed here also does not state a default period for keeping local transcripts, as Claude Code does for its cleanup setting.

Protect existing records and separate hosted storage

Treat local transcript directories as sensitive. Use your operating system to limit access, and check whether backup tools, device-monitoring tools, or tools that sync configuration files copy those directories elsewhere. Hiding a directory or setting an automatic cleanup period does not encrypt its files.

Before sharing a transcript in a support ticket or repository, or sending it to another person, inspect it and remove private information. Remove credentials from tool results as well as prompts. A command’s output can contain a secret even if you never typed it into the conversation.

Local file paths describe where files are stored on your computer, not how long a hosted service keeps data. OpenAI’s Agents API, for example, stores sessions in its hosted service and exposes traces through a dashboard and API. This is separate from a local Codex rollout file. Check the retention and data-handling terms for the hosted product you use; local storage behavior does not tell you how that product handles data.

What I'm building

Delegate tasks. Get software.

Give Vroni a GitHub issue, bug report, spec, or rough idea. It reads the repo, plans the change, writes code, runs checks, and works toward a review-ready pull request.

Take a look at vroni.com