Free Mac app · macOS 13+ on Apple Silicon · 47 rules
Catch the secret before it leaves your Mac.
A small background app that reads the prompt box as you write, finds secrets and PII on the machine, and warns you at the source. Capture is read-only. Nothing sits in your send path, your prompt reaches the tool untouched, and what you type into an AI tool is never sent to us.
4.1 MB · signed and notarized · free forever, no account, no sign-in
What it costs you
One permission, and it is a broad one.
To read your prompt before it is sent, the app reads the composer through the macOS Accessibility API and watches the clipboard. Accessibility is a wide permission and macOS does not offer a narrower one for this. You should know that before you grant it, so here it is first.
Accessibility
Reads the composer
The text of the prompt box in your AI tools, as you type it. That is what the permission buys.
Clipboard
Watches the paste
Most leaks arrive as a paste out of a file you already had open, so the clipboard is where the catch actually happens.
Not installed
Nothing systemwide
No root certificate, no system proxy, no kernel extension. It is an app in your Applications folder.
What you see when it fires
Even the warning shows a mask, never the secret.
In the free app there is no record to write. The prompt is scanned in memory, you get a flag with the value masked, and the bytes are dropped. There is no account holding them, because there is no account.
What it catches
The things you never meant to paste.
The paste you regret
AWS keys, GitHub tokens, private keys, JWTs, database URLs. The usual way a credential enters a prompt is one line copied out of a .env file, and that is exactly the shape these rules are written for.
What was buried in the log
Social security numbers, card numbers and customer emails sitting inside the stack trace you dropped into Cursor to debug. Flagged in the composer, before you hit send.
Every tool at once
Cursor, Claude Code, Copilot, Windsurf. One background agent reads the composer itself, so it sees the prompt even when the tool talks straight to its own cloud. No per-tool setup.
47 hand-written rules, deterministic regex with real validators. 640 tests, and the build fails if any rule carries fewer than 5 positive and 5 negative cases. No model ships in the app, so a catch is explainable and it runs the same with the wifi off.
The network, precisely
Your prompts are never sent. Here is everything that is.
Detection is local and makes no network call at all. The app does talk to our server in exactly three cases, and none of the three carries a word of what you typed into an AI tool.
The update check
On launch it asks our feed whether a newer build exists. It sends a version number and gets an answer.
Weekly totals, if you say so
Off by default. Turn them on and the app sends anonymous weekly counts with no identity attached. Leave them off and it sends nothing.
Feedback, if you write it
The feedback box sends the message you typed, your email if you added one, and the app version and OS. That is the whole payload.
Pull the cable and the app keeps working. Detection never asked the network for anything, and you can ignore the update answer too.
Free app and team product
Same engine. This one has no manager attached.
Nothing is enrolled
No account, no organization, no uplink. You install it, you grant Accessibility, and that is the entire relationship. Free forever.
Masked signal, by enrollment
The same engine in the team build, enrolled to an org with a code. When a rule fires, the evidence is masked on the machine before it is recorded, so a live secret never enters the audit trail. The manager sees a category, a severity, a tool and a count. Never the text.
Install
Three minutes, then try to break it.
01
Open the DMG
Signed and notarized by Apple, so it opens on a normal double-click. One standard first-open confirmation, no blocked-app warning.
02
Grant Accessibility
Launch it once and allow Accessibility in System Settings. This is the permission the whole app rests on.
03
Try to leak something
Type a fake AWS key into Cursor. The warning fires as you type, with the value masked in the alert. Your prompt itself is never touched.
Running a team on these tools? The team product is here.