Safe Send

Safe Send prevents accidental leakage of sensitive data when copying code to AI tools. It scans for secrets (API keys, passwords, tokens) and sanitizes them before they reach your clipboard.

🚀 Quick Start

1. Install from VS Code Extensions (Ctrl+Shift+X → Search "Safe Send")
2. Select code in your editor
3. Right-click → "Safe Send: Scan & Copy for AI"
4. Review results → Copy safely!

🔍 What It Does

Detects 41 Types of Secrets

Patterns are grouped into categories. Each runs with case-insensitive matching where appropriate and is replaced by a placeholder (e.g. <API_KEY>).

Detection is extensible: add your own rules via VS Code settings or a repo-level .safe-send.json (see Configuration).

Risk Levels

Risk is the sum of matched pattern scores, with a floor that forces HIGH whenever a critical secret (real API keys, tokens, private keys) is present, and context adjustments for file type (.env, test files, docs, IaC).

• 🟢 LOW (0–29): no warning (emails, IPs, phones)
• 🟡 MEDIUM (30–59): warning (e.g. a hardcoded password)
• 🔴 HIGH (60–100): warning (API keys, tokens, private keys)

Note: clipboard monitoring only warns on MEDIUM/HIGH; LOW-risk findings are ignored so everyday copying isn't interrupted.

💻 Usage Examples

Example: Secret Detected → Warning

// Before: Contains an API key
const apiKey = "sk-1234567890abcdef";

⚠️ Dialog appears:

• Risk: 60/100 (HIGH)
• Detected: OpenAI API key
• Options: Sanitize & Copy | Copy Anyway | Cancel

✅ After Sanitizing:

const apiKey = "<API_KEY>";

📸 Screenshots

See SCREENSHOTS.md for visual examples.

⚙️ Configuration

Custom Patterns (VS Code settings)

{
  "safeSend.customPatterns": [
    {
      "id": "company_key",
      "label": "Company Key",
      "regex": "COMPANY_[A-Z0-9]{24}",
      "placeholder": "<COMPANY_KEY>",
      "riskScore": 60,
      "critical": true
    }
  ]
}

Repository Config

Create .safe-send.json in your project:

{
  "patterns": [
    { "id": "internal_token", "label": "Internal Token", "regex": "INTERNAL_[A-Z0-9]{32}" }
  ]
}

URL Allow-list

Trusted URL hosts are never redacted or flagged. Supports exact hosts and *.example.com wildcards (case-insensitive, scheme ignored):

{
  "safeSend.urlAllowlist": ["api.example.com", "*.trusted.dev"]
}

All Settings

🔄 Clipboard Monitoring

Safe Send automatically monitors your clipboard:

• ✅ Scans every 200ms
• ✅ Warns for MEDIUM/HIGH risk
• ✅ Ignores LOW risk (emails, IPs, phones)
• ✅ Never blocks clipboard

📊 Quality Metrics

The detection engine is covered by a real node --test suite. Coverage is not measured by a coverage tool in this repo — the earlier "100% coverage" claim has been removed.

🚀 Quick Commands

npm run install:local   # Install locally
npm run remove:local    # Remove local install
npm test                # Compile + run unit tests
pnpm run build          # Build the extension

🔒 Safety & Privacy

• ✅ No data collection
• ✅ No network access
• ✅ 100% offline
• ✅ Open source (MIT)
• ✅ Max 200KB file size

📚 Documentation

• Architecture - Technical design
• Test Data - Example inputs
• User Guide - Testing instructions

💻 Development

git clone https://github.com/chaluvadis/safe-send.git
cd safe-to-send
pnpm install
pnpm run dev:setup