Credentials get scrubbed
Credentials should not be in agent sessions, but sometimes they are. Before anything leaves the machine, the shipper scrubs by pattern everything that looks like one.
The architecture
Description for security leaders, architects, and engineers. Session data is as valuable as server logs, and as sensitive, so it gets the same handling: scrubbed, encrypted, uploaded to your bucket, normalized. The deployment modes show which parts you can run yourself.
The upload path
Deployment mode
Start storing how agents behave before 30-day retention or a wiped device loses it. No analysis with Quesma components. Quesma holds no key.
The archive plus open-source normalization: one format across harnesses and versions, analyzed with your own tools. Quesma holds no key.
Easiest to use and manage. Quesma hosts everything, the control plane and the bucket included, and needs your private key to decrypt the sessions.
You own your data and can inspect it before Quesma processes it. Control plane and bucket run in your cloud. Quesma needs your private key to decrypt the sessions and build the tables.
Everything runs in your environment: AWS, Snowflake, Databricks, and alike. Quesma holds no key. For $2M+ a year of agentic coding spend.
- Read
~/.claude/projects~/.codex/sessions~/.cursor/projectsplus metadata: git remotes, account plan and rate-limit tier. - ScrubSecrets and PII redacted with gitleaks-format rules and an entropy check:
ghp_d23243224q…becomes__REDACTED:github-pat__. Always on: no configuration layer can switch it off. - EncryptUsing your organization public keysage file encryption, X25519 recipients. The recipient list is add-only..
- AuthorizeGet presigned URLs for PUTs from the control plane.
- UploadPresigned URL PUT straight to the bucket over HTTPS.
- Open-source, Apache 2.0
- Go, one static binary
- below 20 MB
- reproducible build (Linux, Windows)Release 0.0.3 rebuilt from source on Linux and Windows with matching hashes.
- signed binaries and updatesmacOS build Developer ID signed and notarized. Updates come from a TUF repository with the root key embedded in the binary; a downgrade is refused.
- Enroll
- Remote Config
- Authorize
Never receives session, can't decrypt the data
- will be open-sourced soon as Apache 2.0
- implements shipper-protocol v0.1.0
- stateless request handlingNo session content and no key pass through it. Stateless, stores small state in the bucket.
- deduplicatesThe shipper asks with a hash of each file before uploading; the control plane answers whether that file is already present.
v1/organization=<org>/install=<uuid>/mirror/source=<source>/<64 hex>.age
- encrypted per customer
- long-term raw archive
6Normalizeto one format
across versions
and harnesses
- re-usable for other services (e.g. security)
- compatible with Snowflake, Databricks and other data warehouses
7Analyze
Precautions
Two layers of protection of your data
Cloud permissions on the bucket, and a per-customer encryption key. The keys are public-private: a writer holds only the public key and cannot decrypt what it wrote. An accidentally shared object does not leak session content.
Auditable and open source
Everything that runs on your devices is open source under Apache 2.0. You are welcome to verify it or contribute.
What the control plane cannot do
It never sees session content and holds no key. It cannot widen what the shipper reads: the scope is compiled into the binary, and a new root needs a release. It cannot remove a reader, a scrub rule, or encryption; a configuration it cannot honor is refused whole, and a local disable beats a remote enable. Quesma staff do not open your sessions; humans get access only on your ticket.
If it runs on your laptop
It reads the agents' own session directories and nothing else: no other files, no keystrokes, no screenshots, no browser history, no process list. Credential stores such as ~/.ssh, ~/.aws, and .env files sit on a compiled deny list. Sessions like these are what improves agents; public datasets such as SWE-chat on Hugging Face are made of them. Quesma works on the raw sessions, but the product shows aggregates by team, repository, and kind of work, not individual prompts. quesma-shipper preview shows what the next run would send.
Who runs what
| Deployment mode | Control plane | Bucket | Tables and analytics | Private key | You deploy |
|---|---|---|---|---|---|
| Open-source archive | Your environment | Your bucket | None | Yours only | Shipper, control plane, bucket |
| Open-source normalization | Your environment | Your bucket | Your tables, your tools | Yours only | Shipper, control plane, bucket, normalizer |
| Professional | Hosted by Quesma | Hosted by Quesma | Hosted by Quesma | Yours, shared with Quesma to decrypt | Shipper |
| Business / Enterprise SaaS | Your cloud | Your bucket | Hosted by Quesma | Yours, shared with Quesma to decrypt | Shipper, control plane, bucket |
| Enterprise BYOC$2M+ a year of agentic coding spend | Your cloud | Your bucket | Your cloud | Yours only | Everything, with Quesma software in your cloud |
Quesma aims to support the major clouds (AWS, GCP, Azure, Cloudflare) and data platforms (Snowflake, Databricks).