shg, the SHell Guard

shg (SHell Guard) is a small program that scans shell history and other history files for credentials such as API keys, passwords, bearer tokens, credential URLs, and private keys, then alerts the user. The author built it because commands containing secrets, like API_KEY=... prefixes, curl --user "name:password" calls, and PGPASSWORD=... psql commands, get saved in history files where malicious programs could read them and backups could preserve them. The tool runs a quick scan when a new shell starts and can also check each command entered in zsh before it is written to ~/.zsh_history. Users can run shg-config discover to find additional history files, adjust output with options like --level and --json, and add false positives to ~/.config/shg/ignore.local.shg.