Check it before you paste it into an AI.
You paste a stack trace into ChatGPT to debug it, and the config was in the stack trace. Around 11% of what people paste into AI chat tools is sensitive, and source code is the largest slice of it. Paste anything below and see what a reviewer would flag.
Or drop a file onto the box. The file is read in this tab and never uploaded —
a .env or a config file is exactly the sort of thing worth checking before it goes anywhere.
Why it isn't noisy
Prefixes, not guesswork
Rules keyed on documented token formats — ghp_, sk_live_,
AKIA — instead of "this string looks random".
Real validation
Card numbers get Luhn. CPF and CNPJ check digits are verified. A random 11-digit order number is not a CPF, and it knows the difference.
Placeholders survive
your-api-key-here is ignored. correct-horse-battery-staple is
still treated as the password it is.
Built for code
Rules hold up inside .env, YAML, escaped JSON, shell export and
fenced code blocks — where the leaks actually are.
Want this to happen automatically?
The browser extension runs the same checks on the paste event itself, in ChatGPT, Claude, Gemini, Copilot, Perplexity and others — so it catches the paste you weren't thinking about. Coming to the extension stores; the source is public meanwhile.