You Just Shared Your API Key With an AI. You Didn’t Even Notice.

说明与用途

用户使用 concealer 将 API 密钥存储在本地加密的保险库中，允许 AI 助手请求密钥名称并安全地注入密钥执行命令，而不会泄露密钥值。

问题

AI coding assistants can inadvertently expose API keys and other secrets stored in .env files, leading to leaks via chat transcripts, logs, or accidental commits.

结果

By encrypting secrets locally and exposing only names to AI assistants, concealer prevents accidental leakage of API keys while still allowing assistants to perform tasks that require secrets.

工作流

• 1. Install concealer (single Python script).
• 2. Encrypt existing .env secrets with concealer, creating a local encrypted vault.
• 3. Configure AI assistant to use concealer’s MCP server for secret access.
• 4. When the assistant needs a secret, it requests the secret name via MCP; concealer returns the name only.
• 5. Assistant calls concealer to run a command with the secret injected; concealer decrypts, sets env vars for the child process, runs the command, redacts secret values from stdout/stderr, and returns sanitized output.
• 6. All interactions are logged with audit trail, but secret values never leave the local machine or the assistant’s context.

证据

Coding assistants read your repository to be useful; the moment an API key lands in a .env file, it can end up in a chat transcript, a log, or a bug report.

来源

concealer ships with an MCP server so AI agents can use secrets safely without ever seeing them.

来源

The plaintext never enters the agent’s context. Not on the way in, not on the way out.

来源