airlock

Stop pasting your secrets into AI chats.

A browser extension that finds API keys, passwords and personal data in whatever you paste into ChatGPT, Claude or Gemini, and replaces them before the chat box ever sees them. It runs entirely on your own computer and makes no network requests.

---

The problem it solves

You paste a stack trace into ChatGPT to work out what went wrong. Somewhere in the middle of it there is an AWS key, a database password, or a customer's email address. That text is now in someone else's system, and you cannot take it back.

The reason this keeps happening is that pasting is a reflex, not a decision. You do it dozens of times a day without stopping to read what is in the buffer.

airlock sits on that reflex. When you paste into an AI chat box, it swaps each secret for a label that says what it was, like [AWS_ACCESS_KEY] or [EMAIL]. The model can still see the shape of your problem, so the answer is still useful, but the secret never leaves your machine. A small message tells you what was caught.

Before  ➜  AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
           DATABASE_URL=postgres://admin:hunter2@db.prod:5432/app
           ANTHROPIC_API_KEY=sk-ant-api03-xTf9...

After   ➜  AWS_ACCESS_KEY_ID=[AWS_ACCESS_KEY]
           DATABASE_URL=[CONNECTION_STRING]/app
           ANTHROPIC_API_KEY=[ANTHROPIC_KEY]

           🔒 Blocked 3 secrets before paste
              AWS_ACCESS_KEY, CONNECTION_STRING, ANTHROPIC_KEY   [ Pause 30s ]

Installing

There is no store listing yet, so you load it from the folder. This takes about a minute and does not require any build step or developer tools.

1. Get the code. Either run git clone https://github.com/KernelSpecter/AirLock-extension.git, or click Code > Download ZIP on this page and unzip it somewhere you will not delete by accident.
2. Open chrome://extensions in Chrome, or edge://extensions in Edge.
3. Turn on Developer mode. The switch is in the top right corner.
4. Click Load unpacked and pick the folder that has manifest.json inside it.
5. To check it works, paste an .env file into claude.ai.

Because it is loaded from a folder, updating means pulling or downloading the code again and clicking the reload arrow on chrome://extensions.

Chrome Web Store and Firefox listings are planned but not done.

Why not just watch the clipboard?

A clipboard watcher cannot see where the text is going. It has no way to tell "pasting into ChatGPT" apart from "pasting my key into my password manager", so it either mangles every secret you ever copy or you end up turning it off. It also has to poll, which means copying and pasting quickly enough can slip a raw secret through before it looks.

airlock reacts to the paste itself, and only on AI chat sites. There is no polling and no race. It never touches what you paste into your password manager, your .env file, or your terminal. Only what is on its way into a chatbot.

What it looks for

Category	Covers
Cloud and API keys	AWS, GCP, Anthropic, OpenAI, Stripe, Slack, SendGrid, Twilio, Google OAuth, npm
Tokens	GitHub personal access tokens, both classic and fine grained, and JWTs
Credentials	Private keys, and connection strings of the form proto://user:pass@host
Generic secrets	Assignments like API_KEY = "...", only when the value looks genuinely random
Personal data	Email addresses, and credit card numbers that pass a Luhn check
Personal data, aggressive mode	Phone numbers, IPv4 addresses, US social security numbers

Why it does not cry wolf

A guard that goes off during ordinary work gets switched off within a day. So everything that is on by default is tuned to be sure rather than thorough:

• Patterns are anchored to the provider. AKIA..., ghp_..., sk-ant-... are matched by their real prefixes and lengths, not by "any long string".
• Card numbers are checked, not guessed. A 16 digit number is only redacted if it is arithmetically a valid card number, so order IDs and timestamps are left alone.
• The catch-all needs real randomness. The secret = "..." rule measures how random the value is, so password="changeme" is ignored.
• The noisy categories are opt in. Phone numbers, IP addresses and SSNs only apply if you turn on aggressive mode in the popup.

There is a test suite of 35 tests (npm test, needs only Node) that checks both halves of that: that real looking secrets are caught, and that ordinary code stays untouched. It also tests the paste handling itself against stand-in page elements.

Private by design

airlock makes no network requests at all. There is no telemetry, no account, no server, and nothing to sign up for. Detection and redaction both happen inside your browser, which is the entire point of a tool whose job is stopping data from leaving it.

The detection rules are all in one readable file, src/engine.js, if you would rather check that yourself than take the paragraph above on trust.

How it works

1. A small script loads only on AI chat sites and waits for a paste.
2. The pasted text goes through the detection rules. Candidates then have to pass a check, such as the card number test or the randomness test, before they count.
3. If anything is found, the paste is cancelled and the cleaned up text is put in instead. This is done in a way that works with React text boxes and with rich editors like the ones Claude and ChatGPT use.
4. A message shows what was blocked, and the toolbar icon keeps a running count.

The command line version

If you would rather work in a terminal, or want this running in CI, the companion airlock CLI uses the same detection rules. You can pipe files through it or install it as a pre-commit hook to keep secrets out of your commits.

Adding a detector

Detectors are plain data in src/engine.js:

D("linear_key", "secret", "LINEAR_KEY", "high", /\blin_api_[A-Za-z0-9]{40}\b/gd),

Add a realistic fake to POSITIVES in tests/engine.test.js, add something that looks similar but is not a secret to NEGATIVES, then run npm test.

Pull requests that add provider coverage are welcome. If you send one, please make the matching change to detectors.py in the CLI repo as well, since the two rule sets are meant to stay identical and there is a test that checks it.

Planned

• Chrome Web Store and Firefox Add-ons listings
• Turning it on and off per site from the popup
• Your own patterns, and an allowlist
• Cover drag and drop and file attachments, not just paste
• An optional local only way to put the original text back

Contributing

Issues and pull requests are welcome, especially new provider patterns and reports of false positives. If something was flagged that should not have been, paste the text that triggered it with the secret itself replaced by X characters.

License

MIT © KernelSpecter