Developers Leak Secrets Into AI Chats Every Day. Most Don't Even Know It.

At my previous job, I worked on a secret scanning tool. The kind that catches leaked API keys and credentials in your codebase before they make it to production. It's important work, and there are already a lot of good tools doing it.

But I kept noticing something that none of them covered.

Every day, developers paste code, logs, and config files into AI chats to debug faster, write better code, and ship sooner. And buried in those pastes are real credentials, real tokens, real secrets. Once you hit send, that data is sitting on someone else's servers. You don't know who sees it, how long it's stored, or where it ends up.

And here's the part most people don't think about. Those prompts you send, the code you paste, your logic, your approach, your secrets, a lot of that can end up as training data. It gets absorbed, stored, logged. You'll never know who sees it or what happens to it after that. People are starting to call it prompt poaching, and it's happening quietly at a massive scale.

That gap bothered me. We had scanners for repos, scanners for CI pipelines, scanners for commits. But nothing that sat between you and the AI chat window. The one place developers share secrets dozens of times a day without even thinking about it.

So I built Secret Sanitizer.

It's a Chrome extension. You paste your code into any AI chat, and it catches your secrets before they ever leave your browser. Masks them, locks the originals in an encrypted vault on your machine, and when the AI responds, you copy the reply and your real values are automatically restored. No extra steps, no friction.

Everything runs locally. No servers, no network calls, no tracking. Fully open source under MIT. Privacy isn't a feature here. It's the entire architecture. Your code stays yours. Your prompts stay yours. Nothing leaves your machine that you didn't mean to share.

Right now, Secret Sanitizer works with AI chat interfaces like ChatGPT, Claude, and Gemini. That's the starting point. On the roadmap, I'm building support for coding agents and agentic workflows where secrets flow even more freely and with even less visibility.

My goal is simple. Give developers the best experience I can, help them use AI safely, and let them ship fast without ever worrying about what they just pasted.