Catches API keys, credentials and personal data before you paste them into an AI chat. Runs entirely in your browser. No account, no upload, no network requests at all.
→ Try it in the browser — paste anything, see what a reviewer would flag, copy a redacted version. Nothing is sent anywhere.
You paste a stack trace into ChatGPT to debug it. The config was in the stack trace.
That is not carelessness, it is ordinary work — and it is routine. Around 11% of what people paste into AI chat tools contains sensitive or confidential data, and source code is the single largest category of it. Shadow AI now accounts for roughly a fifth of breaches.
A browser extension that intercepts the paste event on ChatGPT, Claude, Gemini, Copilot, Perplexity, Mistral, DeepSeek, Poe and others — and a web page running the same engine for when you just want to check something once.
Both share one corpus: 50 rules across 36 providers, plus payment cards, CPF, CNPJ, IBAN and US SSN.
Most tools in this space match a long random-looking string and call it a secret. That flags UUIDs, commit SHAs, minified bundles and version numbers — and after the third false alarm people stop reading the warning, which is worse than having no warning.
| Approach | What it does |
|---|---|
| Prefixes over guesswork | Rules key on documented token formats (ghp_, sk_live_, AKIA) — near-zero false positive |
| Real validation | Luhn for cards; check digits for CPF and CNPJ. A random 11-digit order number is not a CPF |
| Placeholders recognised | your-api-key-here ignored; correct-horse-battery-staple still treated as a password |
| Entropy is secondary | Only applied to assignment-shaped lines, never on its own |
| Built for code | Rules survive .env, YAML, escaped JSON, shell export and fenced blocks |
The false-positive suite is larger than the detection suite. That is deliberate.
- No network requests. No
fetch, noXMLHttpRequest, no beacon anywhere. - No host permissions. The extension is technically incapable of exfiltrating anything.
- Only
storage, for your settings and a per-rule counter. Inspected text is never persisted. build.jsfails if a network call, a host permission or an extra permission is ever introduced — so the claim cannot quietly drift from the code.
node test/scan.test.js # 76 unit checks — detection, false positives, validators, masking
node build.js # verifies, then packages for Chrome, Edge and Firefoxtest/harness.html runs the content script outside an extension for the 25 integration checks
(paste interception, the review dialog, focus trapping, redaction, aggregate-only storage).
Every example value in the corpus is fabricated, and each is assembled from fragments at runtime
rather than written as a whole literal. GitHub's push protection rejected the first version of this
repository and secret scanning flagged two more values afterwards — correctly, since they look
exactly like what this project detects. None was ever a real credential. Rather than clicking
"allow this secret", the fixtures were split and build.js now fails on any credential-shaped
literal in the source.
LeakGuard is an assistive check, not a data-loss-prevention product and not a compliance control. It reduces accidents. It cannot guarantee nothing sensitive ever reaches a chatbot, and any tool claiming otherwise is not telling you the truth.
MIT.