Leakless

Leakless keeps the secrets in your .env files off your screen — during screen shares, streams, recordings, and out of your git history.

Features

1. Auto-blur values in .env files

Every .env, .env.local, .env.production, .env.* file (configurable) has its values masked automatically. Key names stay fully visible — only the text after = is hidden:

API_KEY=••••••••••••••••
DATABASE_URL=••••••••••••••••••••••••••

This is done with VS Code text editor decorations only. The file on disk, and the buffer VS Code holds, are never modified. Comments (#...), blank lines, quoted values ("..."/'...'), and export KEY=value syntax are all handled.

2. Reveal a single value

Each value line gets a small CodeLens above it:

• Reveal — unblurs just that one value.
  • It automatically re-hides after leakless.revealTimeoutSeconds (default 10s), or immediately if the editor/window loses focus.
• Copy value — runs Leakless: Copy Value, which copies the real value straight to your clipboard without ever rendering it on screen.

3. Streaming Mode

Click the lock icon in the status bar (or run Leakless: Toggle Streaming Mode) before you go live. While Streaming Mode is on:

• Every value stays blurred, with no exceptions.
• The Reveal CodeLens is disabled and shows "Blocked by Streaming Mode" instead.
• Any value that was already revealed is immediately re-hidden.

Turn it off again when you're done sharing your screen.

4. Commit warning

VS Code does not expose a built-in API to intercept the Source Control "Commit" action, so Leakless uses a two-layered approach — explained here rather than hidden behind a flag:

1. Leakless: Install Git Pre-Commit Hook — writes a real git pre-commit hook (.git/hooks/pre-commit, plus a small helper script under .vscode/leakless-scan.js) into the current repository. This is a standard git hook, so it runs for every commit, from any tool — VS Code, the terminal, another IDE — and can actually block the commit (non-zero exit code) if it finds a staged .env file or text that looks like a secret (AWS keys, GitHub/OpenAI/Anthropic tokens, private key blocks, generic password=/secret=/token= assignments, etc.). This is the only mechanism that can reliably stop a commit, which is why it's the recommended one.
2. Leakless: Scan Staged Files for Secrets — runs the same scan on demand, from inside VS Code, and shows a modal warning listing every file:line match before you commit, as a convenience when you don't want to install the hook.

Run Leakless: Uninstall Git Pre-Commit Hook to remove it again. Leakless only ever touches a pre-commit hook it created itself — if you already have a custom one, it leaves it alone and tells you so.

If a warning is a false positive, the hook supports the standard git commit --no-verify escape hatch, same as any other git hook.

Settings

Commands

• Leakless: Reveal Value
• Leakless: Copy Value
• Leakless: Toggle Streaming Mode
• Leakless: Scan Staged Files for Secrets
• Leakless: Install Git Pre-Commit Hook
• Leakless: Uninstall Git Pre-Commit Hook

Known limitations

• The underlying value text is kept in the document and rendered transparent rather than truly removed from layout, so a masked line is visually a bit wider than the key alone. The real value is never altered or exposed in the DOM as plain styled text — only as a transparent run the mask is drawn in front of.
• The commit warning's enforcement relies on the installed git hook; the in-editor scan command alone cannot prevent a commit started from the terminal or another tool.
• Detection patterns are heuristics. They catch common key/token formats but are not a substitute for a dedicated secret-scanning service in CI.

Development

npm install
npm run compile   # or: npm run watch

Press F5 in VS Code to launch the Extension Development Host.

npm test          # runs the .env parser and secret-scanner unit tests
npm run package   # builds a .vsix with vsce

License

MIT — see the LICENSE file.