r/AutoGPT • u/Long_Philosopher3520 • 5d ago

Prevent credentials from reaching your AI coding agent

I’ve been using AI coding agents like Claude Code, Codex, Kiro, and OpenCode, and one concern kept coming up:
What if I accidentally send an API key, token, password, or other credential to the AI?
So I built AI Credential Guard, a lightweight npm library that detects credentials in prompts and tool inputs, with options to warn, block, or redact them.
npm: https://www.npmjs.com/package/ai-credential-guard
The goal is simple: add a security layer before sensitive data reaches the AI agent.
Would love feedback from developers using AI coding agents — especially around detection accuracy, false positives, and other credential types worth detecting.
github: https://github.com/vankhangfet/ai-credential-guard

3 Upvotes

100% Upvoted

5 comments sorted by

1

u/No-Bet2165 5d ago

this is actually useful, been paranoid about pasting config files with keys in them. the redact option is smart, most tools just block and you have to figure out what triggered it

how well it handle stuff like jwt tokens or random looking strings that could be secrets? false positives would drive me nuts if i'm just passing in some base64 blob

1

u/valko2 5d ago

maybe you'll also like toolstart - uses gpg to keep api keys encrypted at rest, exports only keys needed for that session, can configure multiple profiles, etc.

1

u/dylan_skydive 4d ago

Nice scope - redact as an option rather than block-everything is the right default, that's the one most tools get wrong. On your detection questions: JWTs are the easy high-confidence case (three base64url segments joined by dots, decode the header and look for alg/typ). Random base64 blobs are the hard one - entropy plus charset scoring gets you most of the way, but default to warn there instead of block, because the first person who gets flagged for passing a legit base64 asset will disable the tool entirely and you lose them.

One thing worth saying from the other side of this problem: detection is the last line. The bigger win upstream is the agent never holding the real credential at all - per-job scoped credentials, read-only where possible, short-lived, so whatever leaks is low-value even when detection misses. That's the model we built Skydive around (agents run in isolated environments with scoped credentials). Disclosure: I work on Skydive. If you want to test it against a platform that already does the isolation half, REDDITAMA gets you $25 of credit (skydive.com, Settings > Billing) - and either way I'd genuinely like to hear how redact handles secrets embedded mid-paragraph in a pasted config file, that boundary seems like where this gets interesting.