How it works · macOS 13+ · Apple Silicon
Where the line is, and what it costs to cross it.
This is the path a prompt takes, in order, and the point at which each part of it stops. Your prompt reaches the tool untouched. Detection runs on the Mac, beside the send path, and matched values are masked before anything is written to our records.
The invariant everything else is built around
A matched value is masked on the machine, before the record exists. The free app sends no prompt data at all. On Team, what leaves is the redacted record: tool, category, severity, the rule that fired, a short content hash, and a masked snippet capped at 500 characters. The matched values are gone from that snippet. The words around them can remain, because context is what makes a record worth reviewing.
Step 1 · capture
We read the composer, not the network.
AI coding tools talk straight to their own servers, and some pin their TLS. Sitting in the middle of that is a bad trade, so the agent reads the text where it is written instead. Two paths, both on the machine, both in the same Rust process.
The tool’s own composer
macOS Accessibility reads the composer text out of the app’s UI tree as you write it, before a byte is sent. It is network-agnostic, which is the only reason it reaches traffic a proxy never could.
The paste
Most secrets enter a prompt as a paste out of a .env file or a terminal scrollback. The agent polls the pasteboard and runs the same rules over what lands there.
Composers we read today
Cursor, Claude Desktop, VS Code with Copilot, Windsurf, ChatGPT Desktop.
Accessibility is a broad permission. Granting it means the process is able to read UI text from apps on the machine, and macOS says so in those words when it asks. We scan the composers listed above and hold that text only long enough to run the rules over it. Nothing is captured to disk. Capture can be paused from the app.
Reading the composer means we are beside the send path, never inside it. There is nothing to add latency, nothing to break the tool, and nothing to route around. We detect as you type and warn in real time, and the prompt goes out exactly as written.
Step 2 · detect
Three tiers. Two of them run.
Detection is one shared Rust crate, used by the free app and the team agent alike. It is deterministic: regular expressions plus real validators, on your machine, with no network call.
Tier 1 · live
47 rules
Hand-written patterns with validators behind them, for things with a hard shape. AWS keys, GitHub tokens, private keys, JWTs, database URLs, SSNs, cards. 640 tests cover them, and the build fails if a rule ships with fewer than 5 positive and 5 negative cases.
Tier 1+ · live, per org
Confidential terms
A team lists its own terms, unreleased product names and codenames. The agent fetches the list and matches it on the device. That list is org configuration. It is never prompt content, and it never travels the other way.
Tier 2 · no model behind it
Semantic
For a leak with no fixed shape, a paraphrased secret or a pasted roadmap. The code path is written and tested and there are no weights behind it, so nothing runs there today. It ships when labeled data shows it beats the rules. Until then, a leak with no shape is a miss.
No model is trained on your prompts. We never collect them, so there is nothing to train on. Rules are also the only tier a manager can argue with, because the answer to “why did this fire” is the name of a rule.
Step 3 · mask
Detected as you type. Recorded masked.
What the record holds instead
Same secret, or a new one
A short content hash travels with each masked value so one key seen four times can later be told apart from four different keys. It exists to correlate, and the value it came from is already gone.
Dropped entirely
A prompt that matched nothing is not an event. It is not stored, not counted and not sent. Only detections become records.
The boundary
What crosses, and what cannot.
The matched value and the raw prompt
Both are scanned in memory and dropped. Neither is written to disk, and neither has a path to our servers. On the free app, no detection is uplinked at all, so the whole loop closes on the laptop.
The redacted record
Tool, category, severity, matched rule IDs, a timestamp, a content hash, and a masked snippet of 500 characters or less, over TLS. That snippet has the matched values removed. Surrounding words you typed can survive in it.
Each rung shows strictly less. Content stays on the device. Redacted signal reaches the manager on Team. De-identified counters reach us only if the census is switched on in the free app, which is off by default, and any cohort under 25 is suppressed before it is shown.
Two planes
One plane we read. One we cannot open.
When a Team agent does uplink, the record splits. The split is the whole design, so it is worth being exact about which half is which.
Aggregatable signal
Tool, category, severity, matched rules, timestamps. This is the only input to Safety Scores, counters and the weekly digest. It is readable on purpose, because the product has to do math on it. The masked snippet is not in this plane; it travels sealed.
An opaque blob
Sealed on the device to the org’s public key. The gateway stores it byte for byte and never parses it. It opens for one thing only, an authorized investigation that leaves a record of itself.
Where the key lives
The keypair is generated in the manager’s browser. The public half is published so agents can seal to it. The private half is wrapped with a passphrase we never receive, and what we hold is that wrapped blob, which we cannot open. Lose the passphrase and the plane is gone for good, including for us.
What this covers is content, not metadata. Plane 1 is readable to us by design, which means we can see that an engineer tripped a critical secret rule in Cursor at 14:02 even when we cannot open a thing. Anyone who tells you end-to-end encryption hides the metadata too is selling you the wrong sentence.
Reaching the sealed content
One route in, and it costs six things.
Investigation Mode is the only door. It is deliberately expensive, because a door that is cheap to open gets opened out of curiosity.
A second factor
The manager re-authenticates at the moment of opening, not once at login.
A chosen reason
Picked from a fixed list. Not a free-text box that can be left blank.
Fifty characters
A written justification, and the API rejects anything shorter than 50 characters.
The engineer is told
Notified when it opens. If our mail path is not live, the API refuses to open one at all.
Twenty-four hours
The window closes itself. There is no extend button, only a new request that costs the same.
It lands in the chain
Appended to a per-org hash chain, on a table that rejects updates and deletes.
Our terms bar this data from performance review, and that line prints on every page of the dashboard. The engineer sees the same page about themselves that the manager sees about them.
Budgets, and one measurement
Numbers we build against.
Three of these are budgets. We build to them and a feature that blows one does not ship. They are not p95s measured across a fleet, and we will not print one of those until we have it. The fourth is the bundle, which we can simply weigh.
Read the boundary, then run it.
The free Mac app is the same detection engine as the paid product, with no account and no manager attached. It is the fastest way to put the detection claims on this page to the test.