Zsh, like most shells, keeps a detailed record of your commands. This history feature is a gift for productivity, but it’s also one of the fastest ways for sensitive data to slip into places it was never meant to live. API keys. Database passwords. SSH credentials. Once they’re in plain text, they’re in risk territory.
Sensitive data in Zsh history is more common than most people think. Type a psql command with a password inline, and it’s stored. Curl a private endpoint with an auth token, and it’s logged. Future you—or anyone with read access—can see it. Even if you trust your environment, backups and sync tools can spread that risk across multiple systems.
The first step to protecting sensitive data in Zsh is to control what gets written to history. The HIST_IGNORE_SPACE setting skips commands that start with a space, so adding a space before a sensitive command keeps it from being saved. HIST_CONTROL=ignoreboth is a start, but safer yet is teaching yourself never to pass secrets inline at all. Use environment variables, runtime prompts, or dedicated secret management tools to keep them out of logs entirely.