Key-Guard for VS Code and Cursor

Warns you the moment you type a credential, and offers to move it into .env.

What it does

Underlines credentials as you type. Errors for documented token formats (AWS, GitHub, GitLab, Stripe, OpenAI, Anthropic and 15 more), warnings for high-entropy strings that only look like secrets.
Quick fix: move to .env. Replaces the literal with an environment lookup in the right syntax for the language, then appends the value to the nearest .env, creating it if needed. The name comes from the assignment, so stripeKey = "..." becomes STRIPE_KEY.
Quick fix: mark as a false positive. Adds keyguard:allow using a comment syntax the file actually accepts.

Findings show a redacted preview and a hash, never the raw value, because diagnostics end up in editor logs.

This is the second line of defence

The extension warns you. It cannot stop a commit, because nothing inside an editor can. For that, install the CLI once:

npm install -g keyguard-cli
keyguard install

That sets a global git hooks path, so every repository on the machine is checked on commit, in every editor and on the command line. The extension and the hook share one detection engine, so they never disagree about what counts as a secret.

Then run keyguard doctor to see what is already exposed: plaintext tokens in your shell config, .env files that are not gitignored, and secrets already in your git history.

Settings

Setting	Default	Purpose
`keyguard.enable`	`true`	Scan open files.
`keyguard.showWarnings`	`true`	Show heuristic entropy matches, the noisiest category. Documented token formats are always reported.
`keyguard.trace.server`	`off`	Log traffic between the editor and the server.

Commands

Command	Purpose
`Key-Guard: Restart Server`	Restart the language server.
`Key-Guard: Scan Workspace In Terminal`	Run a full `keyguard scan`, which covers files you do not have open.

Dependencies

The extension bundles Microsoft's vscode-languageclient, which is the supported way to talk to a language server. The server it launches, and the detection engine inside it, have no third-party dependencies at all.

Key-Guard

Lubu