On-device detection · macOS · 47 rules
Observability for the agentic workforce.
HeimWall is a macOS app. It reads what your engineers type into Cursor, Claude Code, Copilot and ChatGPT Desktop, masks secrets and PII on the laptop before anything is recorded, and writes a tamper-evident log your team can audit.
The prompt still goes where the engineer sent it. We detect and warn. We do not sit in the send path.
Scroll
The problem
The fastest enterprise tool adoption in history shipped without a control plane.
Cursor, Claude Code, Copilot and Windsurf became the default stack in under 24 months. Nobody sees what goes into the prompt: not the engineer in the moment, and not the leader accountable for the whole team. HeimWall gives you that visibility on-device. Managers see categories and counts, never the text.
Samsung 2023 quietly repeats every day.
Engineers paste API keys, customer records and proprietary code into Cursor and Claude Code by accident. Most never know. Managers definitely don’t.
Classic DLP breaks the engineer workflow.
Nightfall, Symantec and Purview were built for email and file uploads. Agentic chat is an entirely different surface. Block rules kill velocity. They get turned off.
Native controls only see their own tool.
Cursor can tell you about Cursor. Copilot about Copilot. Your team uses four tools this quarter, and nobody owns the cross-tool signal. HeimWall watches all of them from one on-device agent.
The DevGPT scan
27,075 real prompts. 1.12% had something in them.
We ran our detector over a public corpus of developer conversations with ChatGPT. 303 prompts contained something that should not have left a laptop, including three API-key-formatted secrets and 49 personal email addresses. This is not a hypothetical.
What the agent does, on the machine
The secret never enters the record.
47 hand-written rules with real validators. Deterministic, on your machine, no network call and no model. Capture is read-only: your prompt reaches the tool untouched, you get the warning as you type, and the record is stored masked. Nothing sits in the send path, so there is nothing to break, nothing to slow down, and nothing to bypass.
The pipeline
Detect. Mask. Record.
Detect
On the laptop, as you type.
The agent reads the composer out of each tool’s own window through the macOS Accessibility API, and it watches the clipboard. A broad permission, and a read-only one: the agent observes what you type, it never sits between you and the tool.
Mask
Before anything is written.
The mask goes on the record, not on your prompt. When a rule fires, the evidence is stored as a hashed placeholder, so the live secret never reaches our database. A tool that watches for secrets and then keeps a database of them is the problem it says it is solving.
Record
Where it cannot be edited.
Every org gets its own hash chain, on a table that rejects updates and deletes. Detection is what gets the agent installed. The record is what it is installed for.
What the manager sees
A category. Never the text.
| Time | Engineer | Tool | Category | Severity | Evidence |
|---|---|---|---|---|---|
| 14:02 | m.chen | Cursor | Secret | critical | 1 masked value |
| 13:47 | a.silva | Claude Desktop | Database | critical | 2 masked values |
| 11:20 | m.chen | Copilot | PII | high | 1 masked value |
| 09:58 | j.park | Windsurf | Proprietary | info | 3 masked values |
Our terms bar this data from performance reviews, and that line prints on every page of the dashboard. The engineer sees the same page about themselves and can pause capture.
Reading the content · 1 of 3
It costs a second factor.
Re-authenticate, pick a reason, and write fifty characters saying why. There is no browsing mode.
Reading the content · 2 of 3
The engineer is told.
They are notified the moment it opens. If our mail path is not live, the API refuses to open one at all.
Reading the content · 3 of 3
It expires, and it is on the record.
Twenty-four hours, then it closes itself. Opening it, the notice, the reveal and the resolution all append to the chain.
For teams
Put it on the fleet, and keep the record.
The team product is the same engine enrolled to an org, with the manager dashboard, end-to-end encryption and the audit chain.
Run it on your own machine first.
The free app is the same detection engine as the paid product, with no account and no manager attached. It sends no prompt data.