Vaultline

Zero-trust context control for AI coding agents. Talk to your model through @vaultline and secrets, PII and internal infrastructure details are replaced with typed placeholders before the request leaves your machine — then substituted back in the answer, so you still read your own real values.

Detection runs entirely locally. No telemetry, no accounts, nothing phoned home.

How it works

You type this:

@vaultline write a python client for https://svc-01.corp.example.internal/api/getToken,
the password is hunter1isnotsecure

The model receives this:

write a python client for https://<<HOSTNAME_1>>/api/getToken, the password is <<PASSWORD_1>>

and you get the answer back with the real host and password already restored in the code. The model reasons perfectly well about <<PASSWORD_1>> — it just never learns what it stands for.

Note the path survives. Only the host identifies your infrastructure; /api/getToken is generic REST vocabulary and is exactly what the model needs to write a working client, so redacting it would cost you a correct answer and protect nothing.

Placeholders are typed and stable: the same value gets the same token for the whole session, so multi-step tool loops keep working. Tool arguments are rehydrated before the tool runs, and every tool result is redacted before it goes back to the model.

Credentials mentioned across turns

Real conversations split a credential over two messages:

you:  ...and the password is
you:  can you replace it with hunter1isnotsecure

The second message has no keyword to anchor on. Vaultline carries the credential context forward for a couple of turns, so the value is still caught. Tune with crossTurnSecretTurns, or switch it off entirely.

What it catches

• Secrets — AWS keys, GitHub/Slack tokens, JWTs, private-key blocks, connection strings, .env-style assignments, and conversational phrasings like "my api key is …".
• PII — emails, phone numbers, government IDs (SSN, Aadhaar, PAN, passport, driver's licence), card numbers (Luhn-checked), account numbers, currency amounts, and usernames / service accounts (svc_corp_uat).
• Infrastructure — URL hosts, internal hostnames, private/public IPs, IPv6, MAC addresses, ports, and file paths that identify an account or an organisation (/Users/you/…, /opt/acme-payments/…). Universal paths like /usr/bin/python and /etc/nginx/nginx.conf are left alone: they are identical on every machine and reveal nothing.
• Business content — a whole-message judgment (strategy, financials) that blocks rather than redacts, since there's no single span to replace.

Structural rules (regex) always run. Contextual detectors are gated by a local embedding model so they only run where they're plausibly relevant — and if that model is unavailable, detection fails open: every detector runs instead of being skipped.

Syntax-aware suppression parses code with tree-sitter so low-precision rules stop firing inside comments, while unambiguous secret rules keep firing there — because commenting out a config line is one of the most ordinary ways a credential ends up in a file.

In the editor

Independently of chat, Vaultline marks up what it finds in open files:

• Highlighting with hover detail — entity type, severity, category, and the rule that fired.
• Ghost text on the cursor's line when it holds something sensitive.
• Lightbulb actions to anonymize one value, a selection, or the whole file.

Highlighting is an affordance, not the enforcement point — it skips the two detectors that need an embedding call, so an unhighlighted value may still be redacted on its way out.

Anonymize and restore

Mask asks for confirmation first, and restore refuses on a masked document rather than guessing.

Commands

The anonymize/restore commands are also in the editor's right-click menu.

Scope: what @vaultline can and can't see

Built on two public, model-agnostic VS Code APIs — vscode.chat.createChatParticipant and vscode.lm. Nothing here is Copilot-specific.

It sees any model that plugs into vscode.lm, and any tool contributed via languageModelTools or native MCP support — as long as the conversation goes through @vaultline.

It does not see another extension's own chat UI that never touches vscode.lm. Assistants that ship a custom webview and make their own network calls have nothing for Vaultline to intercept, and the same is true of standalone CLI tools that talk to their provider directly. GitHub Copilot's own agent mode is not interceptable today either — VS Code exposes no public API for it.

This is a deliberate, checkable boundary rather than a claim of universal coverage: if a request doesn't go through @vaultline, Vaultline never saw it.

First run

The platform-specific builds bundle everything, including the embedding model — they work offline with no setup.

The portable build downloads the model (~23MB) and installs the server's dependencies the first time the embedding server starts. Until it's ready, routing falls back to a local hashing embedder, and detection still runs.

Set embeddingBackend to "hashing" to skip the model server entirely.

Configuration

45 settings under vaultline.*. The ones most worth knowing:

Using your own embedding endpoint

Set embeddingApiUrl, and run Vaultline: Set Embedding API Token if it needs a credential — that keeps the token in your OS keychain rather than in settings.json.

embeddingApiFormat has two presets and an escape hatch:

"vaultline"  POST {baseUrl}/embed-batch     { "texts": [...] }
                                         -> { "embeddings": [[...], ...] }

"openai"     POST {baseUrl}/v1/embeddings   { "input": [...], "model": "..." }
                                         -> { "data": [{ "embedding": [...], "index": 0 }] }

"custom"     describe your own shape with embeddingApiRequestField and
             embeddingApiResponsePath

Nothing here is OpenAI-specific — the presets are just two fixed points of what "custom" expresses, and either can be written out by hand:

// the vaultline preset, spelled out
"embeddingApiFormat": "custom",
"embeddingApiRequestField": "texts",
"embeddingApiResponsePath": "embeddings",

// your own service
"embeddingApiEmbedPath": "/input/text",
"embeddingApiRequestField": "sentences",
"embeddingApiResponsePath": "result.vectors",   // nesting and arrays supported

The response path understands nesting and arrays: embeddings, data[].embedding, result.vectors.

Override the path with embeddingApiEmbedPath if yours differs (/input/text, say). If your endpoint has no health route, set embeddingApiHealthPath to "" — Vaultline otherwise probes GET {baseUrl}/health before using the endpoint, and a missing route means it silently falls back to the built-in hashing embedder and never calls your service.

Routing works by comparing your message against precomputed category centroids, and those only mean anything if they came from the same model doing the comparing. So the first time Vaultline sees a new endpoint it rebuilds them against your model — 72 sentences, one batched call, cached per endpoint. Nothing happens for the default local setup.

Two things worth knowing:

• Rebuilt centroids don't block by default. They gate detection, but the whole-message business-content block stays off until you set trustCustomEmbeddingsForBlocking. An unvalidated model getting that wrong tells a developer their ordinary question is confidential.
• Routing embeds your prompt before redaction. It has to, in order to decide which detectors to run. Self-hosted inside your network, that's fine; a third-party embedding API would see unredacted text, which inverts the point of the tool. Use "embeddingBackend": "hashing" to keep everything local instead — you lose semantic keyword matching and business-content detection, and all other detection is unaffected.

semanticMatchThreshold (default 0.5) was calibrated against MiniLM, so a different model may want a different value.

Privacy

Everything runs locally. The embedding server binds loopback only (127.0.0.1), starting at port 9000 and moving to the next free port if something else already holds it. It is started and stopped by the extension itself. There is no telemetry and no account. The audit log is a local file that, by default, records what type of thing was redacted and never the value.

Pointing embeddingApiUrl at a remote endpoint is the one way to change that, and it is opt-in.

Licensing

Apache-2.0. Bundled third-party components — including sharp (LGPL-3.0) and its vendored libraries — are listed with their licences in THIRD-PARTY-NOTICES.md inside the extension.

Source: github.com/kashyapjain123/vaultline