open-source chat-time secret scanner · status board
ROADMAP
What shipped. What's next. What's not.
Honest status board. The OSS plugin stays MIT forever —
the hosted team layer is an additive surface for fleets, not a paywall
on the local hook. Dates are targets, not promises —
this is a side project for one maintainer.
The local UserPromptSubmit hook is production-shaped. Install via
/plugin install pat-scanner, restart Claude Code, you're
covered for 13 PAT classes on every prompt.
Fleet-deployable — documented pattern for multi-host rollout via Ansible
Latest patch: v0.1.2 (2026-07-29) — docs/brand release. Brought the docs site into NEWELL brand compliance (canonical color tokens, Space Grotesk display face on hero, glassmorphism/gradients/glows stripped, decorative emoji removed), shipped a dedicated /roadmap page with pricing vetted against GitGuardian/Snyk/Doppler/GitHub, and stood up GitHub Pages. No scanner changes — 13 patterns, 18/18 tests, same as v0.1.1. See the releases page for the full history.
// 02 — next
v0.2IN BUILDtarget Q3 2026 · separate product
Hosted team tier.
The local hook solves the single-developer case. v0.2 adds an optional
hosted layer for teams running Claude Code across multiple hosts and
agents — centralized audit rollup, alerting, and org-wide pattern
distribution without per-host config edits.
CENTRALIZED AUDIT DASHBOARD
Every block from every host ships to a single pane. Filter by agent, by pattern, by time window. Exports as JSONL (raw events) or CSV (flattened for auditors). Retention tunable per workspace.
SLACK + TEAMS ALERT ON BLOCK
Real-time notification to a security channel when any agent blocks a prompt. Includes pattern name, host, session link — never includes the token. Optional digest mode for high-volume fleets.
ORG-WIDE PATTERN DISTRIBUTION
Push new patterns from a single source-of-truth to every host. No more scp ~/.config/secret-patterns.local across N machines. Versioned, signed, rollback-able.
SOC2-READY EXPORT
One-click evidence export covering a chosen date range: every block, every bypass, every patterns-file change. Schema documented, stable across releases.
SSO + SCIM
Google Workspace, Microsoft Entra, Okta. Provision/deprovision seats via SCIM. No shared API keys for auth.
OSS PLUGIN
Free · MIT
All v0.1.x features
Local audit log
Custom patterns via ~/.config
Forever free, forever MIT
TEAM (v0.2)
$19 / seat / mo
Centralized dashboard
Slack / Teams alerting
Org-wide patterns
SOC2-ready export
SSO (Google / Okta)
ENTERPRISE
$24 / seat / mo · sales-led
SAML + SCIM
Self-hosted collector
Custom pattern SLAs
Air-gapped deployment
1-year retention default
AGENT SEAT (add-on)
$4 / agent / mo
Sub-seat for Claude Code agents + CI bots
No SSO entitlement
Covers fleet/automation coverage
First-mover — nobody else in market charges this
RETENTION UPSELL
+ $2 / seat / mo
Team default 90 days
Enterprise default 1 year
Longer retention a small upcharge
OVERAGE (ENT ONLY)
> 10K blocks / mo
Only at Enterprise tier
Team stays flat — no surprise bills
Don't charge on hosts or repos
Pricing vetted 2026-07-27 against live comps: GitGuardian ~$18/dev/mo, Snyk Team $25, GitHub Secret Protection standalone $30, Doppler Team $21. $19/seat sits at the floor of the GitGuardian / Snyk band — clearly under GitHub's standalone SKU (narrower scope = cheaper), ~10% under Doppler. Agent-seat line item is first-mover; no competitor in market charges for non-human seats yet. OSS plugin features will not be paywalled — Team tier is additive, not a feature gate. If you want early access or want to shape the feature set, open a discussion.
// 03 — later
v0.3PLANNEDtarget Q4 2026 · OSS plugin
More pattern classes.
The 13 default classes cover the obvious leak vectors. v0.3 expands the
defaults with classes that have been requested or observed in the wild.
Community contributions welcome — one-line-per-pattern format makes PRs
trivial.
GitLab PATv0.3
Bitbucket app passwordv0.3
Linear API keyv0.3
Datadog API keyv0.3
SendGridv0.3
Twiliov0.3
Mailgunv0.3
DigitalOceanv0.3
Cloudflare API tokenv0.3
Herokuv0.3
npm publish (legacy)v0.3
+ your pattern herePR
Contributing a pattern: append one line to patterns/secret-patterns.local, add a test case in tests/test-scan-secrets.sh, run the tests, open a PR. The CONTRIBUTING.md has the full workflow including the POSIX ERE gotchas.
// 04 — later
v0.4PLANNEDtarget Q1 2027 · OSS plugin
Multi-line paste detection.
The current scanner is line-oriented — one grep -E per
line. That catches 95% of real leaks but misses classes that span
lines: PEM private key blocks, .env file pastes, YAML
config with embedded credentials. v0.4 adds stateful multi-line
detection without giving up the bash-only dependency story.
PEM PRIVATE KEY BLOCKS
Detect -----BEGIN ... PRIVATE KEY----- ... -----END as a single leak, even when pasted across many lines. Catches RSA, ECDSA, OpenSSH, PKCS#8.
.ENV FILE PASTES
Multi-line KEY=value blocks with at least one suspicious key name (e.g. *TOKEN*, *SECRET*, *API_KEY*). Balances false-positive risk vs. catch rate.
EMBEDDED YAML / JSON
Structural detection of credentials inside pasted config blobs. Likely requires jq for JSON and a small YAML subset parser for YAML — both still bash-friendly.
Why this is hard: bash line-oriented pipelines are easy to reason about. Multi-line state machines in bash are not. v0.4 will likely introduce a small awk stage between grep and the exit decision — keeps the zero-deps promise, but the code shape changes meaningfully.
// 05 — considering
ideasUNCOMMITTEDno target · may not ship
On the radar, not on the plan.
Things that have come up in conversations or in the maintainer's own
fleet usage. None of these are committed — they're listed so you can
thumbs-up or push back before any code gets written.
MULTI-IDE WEDGE — Cline / Cursor / Aider / Gemini CLI — refactor scan core into a CLI separate from the CC hook. Priority-1: Anthropic shipping a native CC hook is the existential risk, multi-IDE removes it. ~1 weekend.
PreToolUse hook companion — scan tool inputs (Write/Edit/Bash) not just prompts. Catches the case where an agent tries to write a secret to disk.
macOS/BSD grep portability testing — Linux GNU grep is the only tested target today. BSD grep has subtle ERE differences.
Windows native PowerShell port — currently Git Bash only. Native PS port would remove the WSL/Git Bash dependency for Windows users.
Homebrew tap + scoop bucket + npm wrapper — distribution beyond CC plugin marketplace. Captures Aider/Cline/Cursor cohort via standalone CLI shim.
Bundle with OpenClaw defaults + Claude Code starter packs — default-inclusion is the cheapest install (zero user action). PRs to 3-5 popular starter-pack repos.
Statusline integration — surface "blocked N times this session" in the CC statusline for at-a-glance awareness.
Canary-token logging mode — instead of blocking, log only and let the canary approach surface later leaks. Companion to sensitive-canary.
Claude Agent SDK support — currently Claude Code only. Agent SDK uses different hook surface; would need a separate integration.
Have an opinion? Open a discussion with the idea name in the title. Strong thumbs-up signals move items from this list into a version target.
// 06 — out of scope
not doingSCOPE GUARDset expectations
Explicitly not on the roadmap.
Scope creep kills OSS tools. These are common asks that have been
considered and deliberately left out — either because they belong to a
different layer of the stack or because they'd compromise the
zero-deps / local-only promise.
Paywalling the OSS plugin. The local hook stays MIT forever. v0.2 Team tier is additive, not a feature gate on existing features.
Scanning model responses. PAT Scanner is prompt-side (UserPromptSubmit). Response-side rewriting is sensitive-canary's slot — different mechanism, complementary coverage.
Auto-rotating leaked credentials. Vendor-specific, requires creds we don't want to hold. Use your provider's existing rotation API.
Replacing gitleaks / trufflehog. Those are git-time scanners with deep history support. PAT Scanner is chat-time only. Use both — defense in depth works.
Network calls from the hook. The hook runs in your Claude Code session. It will never phone home, even for telemetry. Team tier will be opt-in collector only.
GUI / desktop app. The hook is a bash script. Configuration is a flat file. This is the entire point.
// 07 — window
Why this exists, and for how long.
PAT Scanner is a timing bet. Chat-time secret leak prevention is a
real, unsolved problem at the IDE layer — but the big vendors
are shipping warnings, and blocking is 12-18 months
behind. The wedge is open now. The window closes when Anthropic /
Cursor / GitHub ship native blocking at the platform level.
THE WEDGE — LOCAL, MIT, ZERO-DEPS, 30-SECOND INSTALL
Funded startups (Knostic, Reco, Witness AI, Wald, Dope Security — ~$10-50M each) attack chat-time leaks from the browser/proxy layer at $20-40K/yr enterprise. Nobody owns the bare local hook that runs in your existing Claude Code install, costs nothing, ships in 30 seconds, and is the canonical answer to "how do I stop pasting my Anthropic key into Claude Code." That's PAT Scanner's slot.
THE WAVE — AI-AGENT SECURITY TAM
Agentic AI security market: $1.65B (2026) → $13.52B (2032), 42% CAGR (MarketsandMarkets). NIST AI RMF Measure 2.7 (data leakage) is claimable now; ISO/IEC 42001 Annex A.7 (data handling) aligns as the standard matures. Compliance tailwinds will pull native-blocking requirements into frameworks within 24 months.
THE WINDOW — 12-18 MONTHS
GitHub Copilot shipped a May 2025 sensitive-content warning (driven by Pillar Security research). Cursor has Privacy Mode but no prompt-time detection. Anthropic ships no native leak prevention. All three are 12-18 months from native blocking at the platform level. The play is to land the OSS wedge and the Team-tier revenue before that consolidation wave hits.
EXIT / SUSTAINABILITY
Two scenarios: (1) Acquisition target by 2027 — Lakera and Prompt Security already acquired in 2025 by Check Point and consolidation rollup; a defensible OSS install base + Team tier revenue is the asset buyers pay for. (2) Sustainable independent — the GitGuardian / HackerOne path: $20-50M ARR on the back of OSS adoption. Both require the same inputs: OSS downloads, GitHub stars, named enterprise pilots.
Honest uncertainty: AI-agent security is nascent and consolidating monthly. Vendor native-feature roadmaps are speculation based on May 2025 warning features and public 2026 GitHub roadmap hints. If Cursor or Anthropic ships blocking natively before v0.3, the strategic priority list reshuffles — multi-IDE wedge becomes the only defense.
// 08 — history
Releases so far.
v0.1.0 + v0.1.1 shipped same day (2026-07-27). v0.1.2 follows on
2026-07-29 — docs/brand patch, no scanner changes. Full release
notes on GitHub; short version below.
v0.1.2 — 2026-07-29
Docs/brand release. Docs site brought into NEWELL brand compliance (canonical #0A0A0A / #00FF41 / #1AFF72 palette, Space Grotesk display face on hero — Newell v0.1 restricted to the literal NEWELL wordmark per the brand spec, decorative emoji and separator glyphs removed). Dedicated /roadmap page live with pricing vetted against live vendor rates. GitHub Pages stood up with auto-enablement in CI. SECURITY.md Americanized + 48h→72h ack SLA. FUNDING.yml dead URL dropped. Scanner unchanged: 13 patterns, 18/18 tests passing.
v0.1.1 — 2026-07-27
Marked scan-secrets.sh and test-scan-secrets.sh executable (mode 100755) in git. Fixes Linux /plugin install failing with Permission denied: exit 126. No functional change to the scanner itself.
v0.1.0 — 2026-07-27
Initial public release. 13 PAT classes, UserPromptSubmit hook, bash + jq, MIT. 18/18 tests passing. Plugin marketplace install flow live.
