Jev Secret Guard

Only for unknown formats: the first 3 characters, the length, the character set and up to 300 characters of the surrounding line with the value replaced. Known key formats never leave the machine.

The guard fails toward a human: it asks you instead of allowing or silently blocking, and known key formats are still blocked locally without any API call.

On jev-1.13.0 with 12 unknown-format strings masked exactly as in real use, all 6 real secrets were blocked at scores of 0.85 to 0.90 and none of the 6 harmless strings was blocked. Three of those harmless strings, an HTML id, a cache key and a log reference, were put to you for confirmation, which costs one extra click each.

GitHub, AWS, OpenAI, Anthropic, Stripe, Slack and Google keys and private keys are matched locally and blocked with no API call, and the hook matcher covers Write, Edit and Bash. Placeholders such as your-key-here or sk-xxxx, commit hashes and file paths are ignored entirely and never sent anywhere.

Set TYPESAFE_API_KEY, clone the repo somewhere permanent, and add a PreToolUse hook with matcher Write|Edit|Bash and timeout 5 to ~/.claude/settings.json. The knobs are JEV_SECRET_BLOCK at 0.80, the score that blocks, JEV_SECRET_ASK at 0.30, the score that asks you, JEV_SECRET_TIMEOUT at 3 seconds, and JEV_MODEL. python test_jev_secret_guard.py runs offline with a fake Jev and no key. MIT licensed, and it pairs with jev-auto-approve, which approves safe commands while this stops unsafe output.

The PreToolUse matcher covers Write, Edit and Bash, registered in ~/.claude/settings.json with a 5-second hook timeout, so it sees files about to be written and commands about to run. Known key formats in any of those are blocked locally without an API call; the model is consulted only for unknown high-entropy strings.

Yes. python test_jev_secret_guard.py runs offline against a fake Jev with no key, and the fake keys in the test file are assembled at runtime so secret scanners do not flag the repository itself. It is MIT licensed, was built with Claude Code assistance, and its calibration numbers and tests were run against real Jev rather than the fake.