Your Shell History Knows Too Much About You

Saw a project pop up this week: a zsh plugin that tries to predict your next command, not just autocomplete the one you’re typing. Built by a solo dev, side project, some AI help with the code. Clever idea. History-based, frecency scoring, small Markov chain under the hood. No LLM doing the guessing, which a lot of commenters seemed relieved about.

Then someone pointed out the plugin doesn’t respect HIST_IGNORE_SPACE, the zsh convention where a command with a leading space gets quietly left out of your history. Turns out plenty of people use that trick to keep secrets, tokens, passwords typed inline, out of their shell logs. The plugin was hoovering all of it into a local database anyway.

The dev’s response was decent, to be fair. “Yeah, I’ll fix that.” No defensiveness, no excuses. But it’s a good reminder of something I think about a fair bit in my own work: the interesting feature is never the risky part. The risky part is the boring convention nobody thinks to test for, sitting quietly underneath the interesting feature.

I’ve been doing DevOps long enough to have my own version of this story, more than once. Years back I wrote a small internal tool that logged command output for debugging. Worked beautifully. Except it also logged database connection strings, in plain text, to a file three other teams had read access to. Nobody was malicious. Nobody even really noticed for months. It just sat there, waiting for the wrong Tuesday. Nothing bad happened, as it turned out, but it easily could have.

What struck me more than the bug, though, was one reply in the thread: “GIGO”, said with real contempt, because AI had helped write some of the code. Somebody else pointed out, quite reasonably, that plenty of solo devs shipping their first open-source project have security gaps, AI-assisted or not. That’s just what version one looks like. The instinct to sneer “aislop” the moment something has a rough edge, that’s not scepticism, that’s just being tired and calling it wisdom. I’ve caught myself doing it. It’s an easy trap: assume the tool did the thinking, so the person doesn’t get credit or blame either way.

I’m genuinely fascinated by what AI-assisted coding is doing to the pace of small projects like this. A single person, a weekend, a working plugin with fuzzy matching and directory affinity scoring, that would’ve taken a small team a sprint or two a decade back. I don’t know what that means for junior developers coming up now, whether it’s a leg up or a shortcut past the lessons that used to get learned the hard way. Probably both. I’m not going to pretend I’ve landed on a tidy answer, because I haven’t.

The other thing that got me was smaller, almost throwaway: someone mentioned typing a leading space has kept their commands out of history for years, and multiple long-time zsh users had no idea that convention existed. Ten, fifteen years of daily terminal use, and there’s still a whole layer of the tool nobody told them about. Feels like most of tech, honestly. You can live inside a system for decades and still not know its quiet defaults, the things it does to protect you without ever announcing it.

Anyway. The dev’s fixing the history issue, by the sounds of it. Good on him. And somewhere out there a toddler is trying to lick every powerpoint in the house, which felt like the most relatable line in the whole thread, security vulnerabilities included.