How I keep secrets and personal data out of Claude Code

Description and use

Cloakroom is a Claude Code plugin that masks and restores secrets and personal data, preventing them from leaking to the model while keeping originals local.

Problem

Claude Code reads any file or command output it is given, so API keys, passwords, and personal data in working folders risk leaking to the model.

Outcome

Cloakroom successfully prevents Claude from seeing raw secrets or personal data while allowing the model to perform its tasks, with a reliable restore mechanism that keeps the original values on the local machine.

Workflow

• 1. Cloakroom hooks into Claude Code’s pre‑tool and post‑tool events.
• 2. When Claude reads a file or runs a command, Cloakroom scans the output for known‑shape secrets, checksum‑validated numbers, and free‑text personal data using a local model.
• 3. Detected values are replaced with placeholders (e.g., PII_PERSON_1).
• 4. The original values are stored in an encrypted session vault with a key in the OS secure store.
• 5. When Claude writes a file or runs a command containing placeholders, Cloakroom swaps the real values back in before the tool executes.
• 6. If a prompt contains a secret, Cloakroom blocks the prompt and notifies the user, unless the prompt starts with a special prefix (cr!).
• 7. Users can review false alarms via the local dashboard and create rules to adjust masking behavior.
• 8. OCR is performed locally on images or PDFs to extract and mask text before it reaches Claude.
• 9. Cloakroom handles encoded outputs (e.g., base64) by decoding and scanning them.
• 10. If Cloakroom cannot process a request, the tool call is held back to prevent accidental exposure.

Evidence

Claude Code reads whatever a task touches. Ask it to fix a failing job and it opens the .env, tails the log, greps the support export. Everything it reads goes to the model as context.

Source

Cloakroom sits on those hooks. When Claude reads a file or runs a command, the output goes through Cloakroom first. It looks for: secrets with a known shape, numbers with a checksum, personal data in free text found by a small model that runs locally.

Source

The original values go into an encrypted vault for the session, with the key in your OS's secure store. When Claude writes a file or runs a command that contains a placeholder, the hook swaps the real value back in, locally, just before the tool runs.

Source

If Cloakroom can't check something (the model still loading, the service down, OCR timing out), tool calls are held back rather than waved through.

Source

It's open source, runs locally, needs no account, and works on macOS, Windows and Linux.

Source