LeakLock: Real-Time Secret & Credential Guard

Catch hardcoded secrets as you type, before they enter git and before they leave your machine.

const STRIPE_KEY = "sk_live_••••••••••••••••••••••••••••••••";
                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                    [LeakLock] Stripe Secret Key: Potential credential exposed.
                    Quick Fix: LeakLock: Redact secret (sk_live_...[REDACTED])

Why LeakLock?

In May 2026, stolen publisher credentials compromised the Nx Console extension in the VS Code Marketplace. It was live for only 11 minutes, yet exfiltrated roughly 3,800 repositories.

Eleven minutes is the entire window a leaked credential gives you. Pre-commit hooks help, but secrets committed into local git history require git rebase, reflog purging, and force pushes to undo.

LeakLock catches credentials inside the editor as you type or save:

• Zero history rewrites: Catching a key before git add means it never enters the git object database.
• Low noise while you type: Strict structural patterns only (Tier A) while typing. No squiggly underlines on UUIDs, git hashes, or test fixtures.
• 100% On-Device: Zero network requests. LeakLock never transmits your code or tokens anywhere.

Features

1. As-You-Type Inline Diagnostics (Tier A)

Instantly squiggles credentials as soon as you paste or type them:

• AWS Access Key IDs & Secrets (AKIA..., ASIA..., aws_secret_access_key)
• GitHub Personal Access Tokens (Classic ghp_, OAuth gho_, Fine-grained github_pat_)
• Stripe API Keys (sk_live_, rk_live_, whsec_)
• Slack Tokens & Webhooks (xoxb-, xoxp-, Incoming Webhook URLs)
• Google Cloud / Maps API Keys (AIza...)
• npm Registry Tokens (npm_...)
• Anthropic & OpenAI Keys (sk-ant-..., sk-proj-..., sk-...)
• Private Key Blocks (BEGIN RSA/OPENSSH/EC PRIVATE KEY)
• Database Connection Strings (postgres://, mysql://, mongodb:// with live passwords)

2. One-Click Quick-Fix Redaction

Press Ctrl+. (or Cmd+. on macOS) over any flagged secret:

• Redact Secret: Masks the credential in-place while preserving identifying prefixes (e.g. sk_live_...[REDACTED]).
• Ignore Secret on this line: Adds a leaklock:ignore comment in the file's own comment style (//, #, -- or <!-- -->) for intended test fixtures.

3. On-Save Heuristic Audit (Tier B)

When you save, LeakLock runs Shannon entropy analysis on assigned variables (token = "...", secret: "..."), rejecting dummy values and placeholders while warning about unlabelled high-entropy secrets in the Problems panel.

Commands

• LeakLock: Scan Current File for Secrets: Manually scan the active document.
• LeakLock: Redact All Detected Secrets in Current File: Automatically mask every detected secret across the entire file in one edit transaction.

Extension Settings

• leaklock.enableAsYouType: Toggle real-time inline squiggles while typing (default: true).
• leaklock.enableHeuristicOnSave: Enable advisory entropy scans on file save (default: true).
• leaklock.ignoredFiles: Glob patterns of files to exclude (e.g., node_modules, dist, package-lock.json).

Privacy Guarantee

LeakLock does not request network access. All scanning, regex matching, entropy analysis, and redaction logic runs purely in your local editor process.

License: MIT