Veil: a local-first redaction gate for everything you paste into an AI

Description and use

Veil is a local‑first redaction tool that scans pasted text for secrets and sensitive information, replaces matches with stable placeholders, and outputs a readable, protected version before sending it to an AI assistant.

Problem

AI chat UIs place paste boxes next to sensitive data, risking accidental exposure of secrets, personal information, or confidential content.

Outcome

Veil reduces accidental exposure of secrets when pasting into AI assistants by providing a local, deterministic‑plus‑AI redaction pipeline that outputs stable placeholders, preserving document structure and readability.

Workflow

• 1. User pastes text into Veil’s interface (CLI, web UI, or library).
• 2. Veil runs 18 deterministic regex/validator rules to flag known credentials and patterns.
• 3. Veil performs entropy scanning to catch high‑entropy strings near indicators like SECRET=, while allowlisting common hashes.
• 4. Veil sends the text to a Gemma model via Ollama to identify contextual sensitive spans, requiring verbatim quotes.
• 5. Veil merges findings, prioritizing precise detections and discarding overlapping or vague model outputs.
• 6. Veil replaces each sensitive span with a stable placeholder (e.g., [EMAIL_1], [AWS_KEY_1]).
• 7. The redacted text and a findings list are presented to the user for review or piping into an AI chat.

Evidence

Veil scans text for credentials, personal information, internal identifiers, and contextual leaks, then replaces sensitive content with stable placeholders before you send it anywhere.

Source

It detects AWS keys, GitHub/Slack/Stripe/Google/OpenAI tokens, JWTs, PEM blocks, database URLs with inline passwords, Luhn-checked card numbers, emails, phone numbers, private IPs, and internal hostnames.

Source

The project is MIT licensed, has zero runtime dependencies, and supports swapping models through VEIL_MODEL.

Source

The deterministic scan runs in approximately 3 ms on the sample fixture, according to my local testing.

Source