Your coding agent just read your API keys. I built a local check so they don't reach the model.

A developer has introduced a security solution to prevent coding agents from inadvertently leaking sensitive data like API keys and passwords to hosted AI models. When coding agents read local files, they often transmit file contents to providers like OpenAI or Anthropic. To mitigate this, the author developed a plugin for Torana, an open-source, local-first proxy. The plugin uses a small, locally-run AI model to scan tool outputs before they are sent to the cloud. If sensitive information is detected, the plugin replaces the output with a warning, ensuring the original data remains on the user's machine. The author tested various local models, finding that while performance varies, models like Qwen2.5 3B are effective at identifying secrets. This tool provides an additional layer of privacy for engineers who rely on AI-assisted workflows, emphasizing the importance of local oversight in AI development.