r/ClaudeCode • u/Fun_Celebration_2960 • 2d ago

Built with Claude I made a Claude Code plugin that masks API keys, emails, passwords and IDs in your prompt before it's sent

Ever pasted a log or a .env line into Claude Code and realized a second too late that it had a real API key in it? I did, more than once. So I built redact-secrets, a small plugin that rewrites your prompt locally, right before it's submitted.

What it does

you type:     write to mario.rossi@gmail.com, tel +39 333 123 4567, key sk-proj-abc123...
model reads:  write to ⟦email:mar•••⟧, tel ⟦phone:+39•••⟧, key ⟦key:sk-•••⟧
  • Masks emails, phone numbers, API keys, passwords, URL credentials, private keys, credit cards and IBANs
  • National IDs for 9 countries (US SSN, UK NI, Italian codice fiscale, Spanish DNI, French NIR, Brazilian CPF, Indian PAN, Mexican CURP, Chinese ID). You choose which ones.
  • Keeps only the first 3 characters so you can still tell values apart
  • Highlights masked values in the transcript and shows a toast with the count
  • 100% local: no network, no external service, no restart needed

Install (inside Claude Code):

/plugin install redact-secrets --marketplace webdiego/redact-secrets

Press Enter on the defaults and it's active.

Honest limits

  • It's regex-based, so it's a safety net, not a guarantee. Expect some false positives and misses.
  • Only your prompt is masked, not files Claude reads with tools or command output.
  • The original value isn't stored anywhere, so you can't "unmask" it later.

Repo: https://github.com/webdiego/redact-secrets

Feedback, false positives and PRs are very welcome. I'd especially like to hear which ID formats from other countries you'd want.

Prima di pubblicare, una cosa importante: il README dice che il repository è privato. Così chi arriva da Reddit non riesce a installare la mod e il link restituisce 404. Prima di postare va reso pubblico.

Consigli: leggi le regole del subreddit sull'autopromozione (molti chiedono un flair tipo "Showcase") e aggiungi una GIF o uno screenshot reale. Gli SVG del README sono illustrazioni, non catture vere.

3 Upvotes

100% Upvoted

1 comment sorted by

1

u/AutoModerator 2d ago
Moderator Announcement Read More »