Like a lot of you, I routinely paste logs, stack traces and .env snippets into AI tools. Every so often a real key slips through, so I built LeakGoblin.

It's a small TypeScript CLI that works on stdin or a directory:

bash

npx leakgoblin scan --stdin < prompt.txt
cat prompt.txt | leakgoblin sanitize --stdin > safe.txt
leakgoblin scan . --format json

What it does:

• Format-specific signatures (AWS, GitHub, Stripe, Slack, Google, OpenAI-style keys, private key blocks, JWTs, connection strings) plus a clearly labeled low-confidence entropy heuristic
• Output is always masked, and JSON output strips raw values
• Runs fully offline, with no telemetry
• CI-friendly exit codes (0 clean / 1 found / 2 error)
• Config file for custom patterns, thresholds and an allowlist

It is a best-effort filter, not a guarantee. It will miss unusual formats, so review the output before sharing.

npm: https://www.npmjs.com/package/leakgoblin GitHub: https://github.com/lovixcloud/leakgoblin

I'd love feedback on false positives and missed formats in particular. Send me a synthetic example and I'll add a rule.