ContextVeil
Lets coding agents read files with secrets while redacting values from the LLM
Emerged finds new products worth a look, daily — what’s new today
It catches the kind of leak you cannot grep for, a key copied into a trace, a log or the model's own context, and names where it went without printing it.
Weir works two ways. For agents you build, it plants fake credentials, runs the agent, then searches telemetry, logs, console output, model requests and outbound calls for those exact values; a GitHub Action runs the same check on pull requests. For agents you use, it inventories real keys as fingerprints and adds a Claude Code status line, with a hook that redacts known values from tool results. Apache-2.0, 199 commits, and one MLflow vulnerability found and fixed in 3.17.0. Whole values only, nothing hashed or split.
More like this
Shield KYA
A local ledger of every tool call your coding agents make
TokenEconomizer
Cuts what Claude Code and Codex spend in a repo you work in daily
BLA
Hardens your shipped builds so AI reverse-engineering agents waste effort
monkeys
Secrets stay in your OS keychain; the repo records only the key names
PatchAndShip Check
A free key-leak scan for the app you shipped without reading the headers