I never installed any "secrets scanner", because of fear it might mess with legitimate tool usage / model context in unexpected ways.
The primary goal of this tool is to adress this. So all "smartness" is in the (human controlled) setup with heuristics helping finding relevant secrets. A plain config file stores references (not secrets themselves), and the runtime harness hook resolves these values and does a literal search + replace for LLM bound text.
Example: It does not block reading `.env.local` but only redacts secrets that were configured in the setup step. This way, the relevant config values can be read by the LLM (and probably the LLM has less incentive to work around to read the full file anyways..).
This intentionally does not cover all ways secrets can escape (direct exfiltration to third parties, transformed values - e.g. base64, unknown secrets, ...) - but I think, the value of "not being afraid to get obstructed" would outweigh that. Also, accidental disclosures shoud be covered rather well.
Currently Claud Code + experimental Codex, Copilot, OpenCode support.
Runs fully local and is free and open source.
I never installed any "secrets scanner", because of fear it might mess with legitimate tool usage / model context in unexpected ways.
The primary goal of this tool is to adress this. So all "smartness" is in the (human controlled) setup with heuristics helping finding relevant secrets. A plain config file stores references (not secrets themselves), and the runtime harness hook resolves these values and does a literal search + replace for LLM bound text.
Example: It does not block reading `.env.local` but only redacts secrets that were configured in the setup step. This way, the relevant config values can be read by the LLM (and probably the LLM has less incentive to work around to read the full file anyways..).
This intentionally does not cover all ways secrets can escape (direct exfiltration to third parties, transformed values - e.g. base64, unknown secrets, ...) - but I think, the value of "not being afraid to get obstructed" would outweigh that. Also, accidental disclosures shoud be covered rather well.
Currently Claud Code + experimental Codex, Copilot, OpenCode support. Runs fully local and is free and open source.
Let me know: Why would you (not) use it?