PasteShield — AI Prompt & Clipboard Secret Sanitizer
Stop leaking production .env secrets, API keys, JWTs, database URIs, and internal corporate endpoints into ChatGPT, Claude, Cursor, or Copilot prompts.
PasteShield is a 100% offline, zero-dependency, reversible secret sanitizer for VS Code and Cursor. Unlike destructive redaction tools that turn secrets into ***REDACTED*** (breaking AI code replies when you paste them back), PasteShield maps every unique credential to a deterministic semantic placeholder in local RAM (<OPENAI_KEY_1>, <DB_URI_1>, <INTERNAL_IP_1>) — and restores real values in 1 click when you copy the AI's solution back.
How Reversible AI Sanitization Works
Copy Sanitized for AI (Cmd+Alt+C / Ctrl+Alt+C)
Highlight .env files, stack traces, Kubernetes configs, or application code:
OPENAI_API_KEY=sk-proj-9a8b7c6d5e4f3g2h1i0j9k8l7m6n5o4p
DATABASE_URL="postgresql://svc_app:Pr0dP4ss!@10.24.8.15:5432/orders"
PasteShield copies clean, LLM-friendly context to your clipboard while vaulting real values strictly in local process memory:
OPENAI_API_KEY=<OPENAI_KEY_1>
DATABASE_URL="<DB_URI_1>"
Ask Any AI Assistant Safely
ChatGPT, Claude, DeepSeek, or Cursor sees exact variable types and cross-file equality (<OPENAI_KEY_1> in file A == <OPENAI_KEY_1> in file B) without ever seeing a single byte of your secrets.
Restore Original Values in 1 Click (Cmd+Alt+R / Ctrl+Alt+R)
Copy the AI's refactored code containing <OPENAI_KEY_1> and <DB_URI_1>, trigger PasteShield: Restore Original Values from Clipboard / Selection, and your real credentials are restored locally with zero manual editing.
10 Built-In Secret & PII Detectors (Free Forever)
| Placeholder Token |
Detected Credentials & Patterns |
<OPENAI_KEY_N> |
OpenAI (sk-..., sk-proj-..., sk-svcacct-...) & Anthropic (sk-ant-...) keys |
<AWS_ACCESS_KEY_N> |
AWS IAM Access Key IDs (AKIA..., ASIA..., ABIA..., ACCA...) |
<GITHUB_TOKEN_N> |
GitHub Classic PATs (ghp_...), OAuth/App tokens (gho_, ghu_, ghs_, ghr_), Fine-Grained (github_pat_...) |
<BEARER_JWT_N> |
3-part signed JWTs (eyJ...) and Authorization: Bearer <token> headers |
<AZURE_CONN_STR_N> |
Azure Storage, Service Bus, Cosmos DB, IoT Hub & Azure SQL connection strings |
<DB_URI_N> |
PostgreSQL, MySQL, MariaDB, MongoDB, Redis, AMQP & ClickHouse URIs with embedded credentials |
<PRIVATE_KEY_BLOCK_N> |
Multi-line PEM, RSA, EC, OpenSSH & PGP BEGIN ... PRIVATE KEY blocks |
<INTERNAL_IP_N> |
RFC1918 (10.x, 172.16-31.x, 192.168.x) & Tailscale/CGNAT (100.64-127.x) private IPv4s |
<EMAIL_N> |
Internal & customer email addresses |
<ENV_SECRET_N> |
.env / YAML / JSON secret assignments (*_SECRET, *_PASSWORD, *_TOKEN, *_API_KEY) + Stripe, Slack, Google API, SendGrid, npm & PyPI tokens |
Commands & Keyboard Shortcuts
| Command |
macOS |
Windows / Linux |
Tier |
PasteShield: Copy Sanitized Selection for AI |
Cmd+Alt+C |
Ctrl+Alt+C |
Free |
PasteShield: Sanitize Current Editor |
Cmd+Alt+S |
Ctrl+Alt+S |
Free |
PasteShield: Restore Original Values from Clipboard / Selection |
Cmd+Alt+R |
Ctrl+Alt+R |
Free |
PasteShield: Restore Placeholders from Session Vault |
Command Palette |
Command Palette |
Free |
PasteShield: Export Multi-File Sanitized AI Markdown Context Pack |
Explorer / Palette |
Explorer / Palette |
Pro |
PasteShield: Scan Workspace / Git Diff for Secret Leaks |
Command Palette |
Command Palette |
Pro |
PasteShield: Activate Pro License Key |
Command Palette |
Command Palette |
Pro |
PasteShield Pro ($9 One-Time, Offline Verified)
Upgrade once with a lifetime offline license key (SHIELDPRO-XXXX-XXXX-XXXXXX or CraftLeaf STUDIOALL-... All-Access Pass) — no account, no cloud server, works in air-gapped corporate environments:
- Custom Regex & Company Domain Rules (
pasteshield.companyDomains / pasteshield.customPatterns): Automatically redact internal hostnames (*.corp.acme.internal -> <COMPANY_DOMAIN_1>), Jira/Linear project codes, customer IDs, or proprietary token formats.
- Multi-File Sanitized AI Markdown Context Pack: Bundle all open editor tabs or any Explorer folder into one LLM-ready Markdown prompt where shared secrets receive identical cross-file placeholders.
- Workspace & Git Diff Secret Leak Audit Report: Scan uncommitted
git diff lines or your entire workspace and generate a masked severity audit table before pushing commits.
Live Interactive Browser Playground & Pro Keys: https://963239327.github.io/craftleaf-studio/extensions/pasteshield/
Zero-Trust Security Architecture
- Zero Runtime Dependencies: Pure auditable JavaScript (
extension.js + sanitizer-core.js). No node_modules supply-chain surface.
- Zero Network Calls: Vault mappings live exclusively in volatile extension host RAM and are automatically purged when VS Code / Cursor closes (or anytime via
PasteShield: Clear Session Vault).
- Offline License Checksum: Pro activation validates cryptographically in-memory with zero phone-home requests.
| |
