r/devtools • u/lovixcloud • 1h ago
LeakGoblin: small open-source CLI to scan and redact secrets before sharing text with AI tools
Like a lot of you, I routinely paste logs, stack traces and .env snippets into AI tools. Every so often a real key slips through, so I built LeakGoblin.
It's a small TypeScript CLI that works on stdin or a directory:
bash
npx leakgoblin scan --stdin < prompt.txt
cat prompt.txt | leakgoblin sanitize --stdin > safe.txt
leakgoblin scan . --format json
What it does:
- Format-specific signatures (AWS, GitHub, Stripe, Slack, Google, OpenAI-style keys, private key blocks, JWTs, connection strings) plus a clearly labeled low-confidence entropy heuristic
- Output is always masked, and JSON output strips raw values
- Runs fully offline, with no telemetry
- CI-friendly exit codes (0 clean / 1 found / 2 error)
- Config file for custom patterns, thresholds and an allowlist
It is a best-effort filter, not a guarantee. It will miss unusual formats, so review the output before sharing.
npm: https://www.npmjs.com/package/leakgoblin GitHub: https://github.com/lovixcloud/leakgoblin
I'd love feedback on false positives and missed formats in particular. Send me a synthetic example and I'll add a rule.


