Did my
agent leak?
Nobody decided to publish it. Your agent wrote CLAUDE.md so it could work on the repo; the internal notes were for your team; the source map was for debugging. Then a release packed the folder and sent it out — and registries don’t forget. Every install since has a copy. Type a package name and find out what yours has been shipping.
Enter a published package name, for example @scope/package. We audit its last ten releases.
No package in mind? Try — its published package includes the repository’s own CLAUDE.md.
Queued...
Release timeline — newest last
How it works
We download the package's recent published artifacts — the exact files every install gets.
Each version is compared to the one before it. A leak is something that STARTED shipping — not noise about what was always there.
Agent instruction files, internal docs, embedded source, credential-shaped content, VCS internals — explained, not jargon.
Checks run against published registry artifacts only — the same files anyone can download. Package contents are processed in a temporary directory and deleted; what we keep is the verdict itself (counts, severities, and non-sensitive file paths), never your code.