PAT SCANNER Catch leaks at the actual point of leak.

A UserPromptSubmit hook for Claude Code. Catches 13 personal access token classes — Figma, Anthropic, OpenAI, GitHub, Slack, Stripe, PyPI, Z.ai, JWT, Natural, AWS — before they enter the transcript. Bash + jq, zero deps, MIT.

/plugin install pat-scanner Read the README →

claude code — prompt

> help me debug this Figma plugin, my token is figd_••••••••••••••••••••••••••••••••••••••• ✗ PROMPT BLOCKED — pat scanner Figma PAT Pattern matched: figd_[A-Za-z0-9]{40,} Token not sent to model. Not written to disk. Bypass with BYPASS_SECRET_SCAN · Real creds go in .env via shell, never chat. $ tail -1 ~/.pat-scanner/audit.log 2026-07-30 14:21:33 BLOCKED name=Figma PAT session=96d067dd-0674-4121-8119-497f7700e4cd

// 01 — flow

From paste to block in under 50ms.

Pre-commit hooks catch leaks at git time — after the secret is on disk, after the transcript mentions it, after the AI has already read it. PAT Scanner fires at chat time, on the prompt itself, before Claude ever sees the token. Companion defense, not a replacement.

STEP 01

PASTE

You paste a Figma PAT (or any of the 13 classes) into the Claude Code prompt. The hook fires before the prompt is sent to the model.

STEP 02

SCAN

The bash script reads your prompt, runs 13 POSIX ERE patterns via grep -E, and matches against the canonical shapes — no false-positive hunting.

STEP 03

BLOCK

Exit 2. Claude Code aborts the prompt with the matched pattern name in stderr. The token never enters the transcript, never reaches Anthropic, never hits disk.

STEP 04

AUDIT

One line appended to ~/.pat-scanner/audit.log: timestamp, pattern name, session UUID. No token, ever. Ship it to your log collector.

// 02 — terminal

See it block a leak in 5 seconds.

Paste a Figma PAT into Claude Code. Watch the hook fire, the prompt abort, and the audit log capture the event — without ever persisting the token.

claude code — prompt

> help me debug this Figma plugin, my token is figd_REAL_TOKEN_WILL_NOT_RENDER_HERE PROMPT BLOCKED — pat scanner Figma PAT Pattern matched: figd_[A-Za-z0-9]{40,} The token was not sent to the model and was not written to disk. To bypass when debugging the scanner: include BYPASS_SECRET_SCAN in the prompt. For real credentials: write them to .env via shell, never chat. $ tail -1 ~/.pat-scanner/audit.log 2026-07-27 19:55:21 BLOCKED name=Figma PAT session=96d067dd-0674-4121-8119-497f7700e4cd

// 03 — what it catches

Thirteen classes out of the box.

Default patterns ship in patterns/secret-patterns.local. One POSIX ERE per line, optional # Name comment becomes the stderr message on block. Add your own at ~/.config/secret-patterns.local — they survive plugin updates.

Service	Pattern shape
Figma	figd_<40+ chars>
Anthropic	sk-ant-api03-<93 chars>AA
OpenAI legacy	sk-<20>T3BlbkFJ<20>
OpenAI project	sk-proj-<58>T3BlbkFJ<58>
GitHub classic	gh[pousr]_<36>
GitHub fine-grained	github_pat_<82>
Slack	xox[baprs]-<10+>
Stripe	(sk\|rk\|pk)_(test\|live\|prod)_<10-99>
PyPI	pypi-AgEIcHlwaS5vcmc<50-1000>
Z.ai / Zhipu	<32 hex>.<16 alphanum>
JWT (generic)	eyJ<10+>.<10+>.<10+>
Natural.com	ak_ntl_prod_<36>
AWS	AKIA<16 upper alnum>

// 04 — shape

Inspectable. Customizable. Fail-open by design.

One file drives the ruleset. One log captures the events. No telemetry, no network calls, no SaaS dependency.

~/.config/secret-patterns.local

# One POSIX ERE per line. Trailing # Name = stderr message.
# User file takes precedence over plugin defaults.

myorg_[a-z]{8}_[a-f0-9]{32}                                # MyOrg internal API key
npx_[A-Za-z0-9]{36}                                        # npm publish token (legacy)
gtu_[A-Za-z0-9]{22}                                        # Linear API key (v2)

# POSIX ERE gotchas (learned the hard way):
# - no (?:...) non-capturing groups — use (...)
# - no \s \d \w — use [[:space:]] [0-9] [A-Za-z0-9_]
# - smoke-test before relying: echo "<sample>" | grep -E "<pat>"

Your user file overrides plugin defaults and survives /plugin update. Drop a new pattern in, restart Claude Code, you're done.

~/.pat-scanner/audit.log

# one line per block. no token, ever.
2026-07-27 19:55:21  BLOCKED  name=Figma PAT            session=96d067dd-...
2026-07-27 20:02:14  BLOCKED  name=Anthropic API key    session=a421ce88-...
2026-07-27 20:14:09  BLOCKED  name=Stripe live secret   session=7f9b2c01-...
2026-07-27 20:18:42  BLOCKED  name=PyPI token            session=c835ad97-...
2026-07-27 20:33:50  BLOCKED  name=AWS access key        session=e19bd7f4-...

# override path with $PAT_SCANNER_AUDIT_LOG
# disable by pointing at /dev/null
# ship to central SIEM via your standard log collector

If the patterns file is missing or unreadable, the scanner exits 0 with a stderr warning — a missing file never blocks all of Claude Code.

// 05 — landscape

Companion, not competitor.

Gitleaks and TruffleHog are excellent at what they do — scanning repos and git history at commit time. PAT Scanner occupies a different slot: the chat-time gate. Use both. Defense in depth works.

Tool	When it fires	What PAT Scanner does differently
Gitleaks, TruffleHog	git-time	Catches the leak before it lands on disk. PAT Scanner is the earlier gate; the git-time scanners are the safety net for when humans (or AI agents) slip past it.
GitHub Secret Scanning	push-time	Provider-side, retroactive, only covers partner services. PAT Scanner covers 13 classes including generic JWTs and org-internal shapes you define yourself.
sensitive-canary (plugin)	chat-time	Canary-token approach — uses CC's PostToolUse output rewrite. PAT Scanner uses UserPromptSubmit with exit 2, blocking the prompt entirely. Different mechanism, complementary coverage.
Commercial CASB / DLP	network-time	Sits between you and the LLM API, requires MITM TLS, costs $$/seat. PAT Scanner runs locally in your existing Claude Code install. Zero network, zero cost.

// 06 — roadmap

The OSS plugin stays free forever.
Hosted team tier arriving v0.2.

The local hook is MIT and always will be. v0.2 adds an optional hosted layer for teams running Claude Code at fleet scale — centralized audit rollup, Slack/Teams alerting on block, SOC2-ready export, org-wide pattern distribution.

OSS PLUGIN

Free · MIT

13 PAT classes out of the box
UserPromptSubmit block + audit log
Custom patterns via ~/.config
Bypass via BYPASS_SECRET_SCAN
Single-host, zero deps

TEAM (v0.2)

$19 / seat / mo

Centralized audit dashboard
Slack / Teams alert on block
Org-wide pattern distribution
SOC2-ready event export
Multi-host rollup

ENTERPRISE

sales-led

SSO + SCIM
Self-hosted collector
Custom pattern SLAs
Air-gapped deployment
Dedicated support

Full roadmap →