Being explicit, because ShortIT reads files that contain your work:
| Path | Access | Why |
|---|---|---|
~/.claude/projects/**/*.jsonl |
read | Session transcripts — the source of all token/cost numbers |
~/.claude/CLAUDE.md, MEMORY.md, rules/, skills/*/SKILL.md |
read | Sizing resident context |
~/.claude/settings.json, ./.mcp.json, ./.claude/settings*.json |
read | Counting configured MCP servers |
./CLAUDE.md, ./AGENTS.md |
read | Sizing project instructions |
~/.claude/shortit-baseline.json |
write | Only on savings_report.py baseline |
Nothing else is written. Nothing is deleted.
None by default. All three scripts are local-only.
The single exception is context_audit.py --exact, which you must opt into. It
calls the Anthropic token-counting API and, in doing so, sends the text of
your CLAUDE.md, rules, and skill descriptions to that endpoint for counting.
Do not use --exact if those files contain material you cannot send off-machine.
Without the flag, a local character-count heuristic is used instead.
Session transcripts can include source code, file paths, credentials pasted into
a session, and internal project detail. ShortIT only reads token-usage fields —
but its --json output includes project directory names, which often carry
client or project identifiers.
Before sharing audit output in an issue, a PR, or anywhere public:
python3 scripts/token_audit.py --json | python3 -c "
import json,sys
d = json.load(sys.stdin)
d['projects'] = {f'project-{i}': v for i, v in enumerate(d['projects'].values())}
print(json.dumps(d, indent=2))
"That strips directory names while keeping every number intact.
Do not open a public issue.
Use GitHub's private vulnerability reporting on this repository: Security → Report a vulnerability. If that is unavailable, open a public issue containing only "requesting a private channel for a security report" and no details.
Please include: what the issue is, how to reproduce it, and the impact you see.
Response expectations. This is a small project maintained in spare time. Expect an acknowledgement within about a week. There is no bug bounty and no guaranteed patch timeline. Coordinated disclosure is appreciated — please allow a reasonable window before publishing.
In scope: ShortIT writing outside the paths listed above; leaking transcript
contents; a script executing data read from a transcript or config file; the
--exact path sending more than it documents.
Out of scope: vulnerabilities in Claude Code itself (report those to Anthropic), and the inherent sensitivity of your own transcripts.
The latest release on main only. There are no backported fixes.