Vaultline

Zero-trust context control for AI coding agents. Talk to your model through @vaultline and secrets, PII and internal infrastructure details are replaced with typed placeholders before the request leaves your machine — then substituted back in the answer, so you still read your own real values.

Detection runs entirely locally. No telemetry, no accounts, nothing phoned home.

How it works

You type this:

@vaultline write a python client for https://svc-01.corp.example.internal/api/getToken,
the password is hunter1isnotsecure

The model receives this:

write a python client for <<URL_1>>, the password is <<PASSWORD_1>>

and you get the answer back with the real URL and password already restored in the code. The model reasons perfectly well about <<PASSWORD_1>> — it just never learns what it stands for.

Placeholders are typed and stable: the same value gets the same token for the whole session, so multi-step tool loops keep working. Tool arguments are rehydrated before the tool runs, and every tool result is redacted before it goes back to the model.

Credentials mentioned across turns

Real conversations split a credential over two messages:

you:  ...and the password is
you:  can you replace it with hunter1isnotsecure

The second message has no keyword to anchor on. Vaultline carries the credential context forward for a couple of turns, so the value is still caught. Tune with crossTurnSecretTurns, or switch it off entirely.

What it catches

• Secrets — AWS keys, GitHub/Slack tokens, JWTs, private-key blocks, connection strings, .env-style assignments, and conversational phrasings like "my api key is …".
• PII — emails, phone numbers, government IDs (SSN, Aadhaar, PAN, passport, driver's licence), card numbers (Luhn-checked), account numbers, currency amounts.
• Infrastructure — internal URLs and hostnames, private/public IPs, IPv6, MAC addresses, ports, file paths.
• Business content — a whole-message judgment (strategy, financials) that blocks rather than redacts, since there's no single span to replace.

Structural rules (regex) always run. Contextual detectors are gated by a local embedding model so they only run where they're plausibly relevant — and if that model is unavailable, detection fails open: every detector runs instead of being skipped.

Syntax-aware suppression parses code with tree-sitter so low-precision rules stop firing inside comments, while unambiguous secret rules keep firing there — because commenting out a config line is one of the most ordinary ways a credential ends up in a file.

In the editor

Independently of chat, Vaultline marks up what it finds in open files:

• Highlighting with hover detail — entity type, severity, category, and the rule that fired.
• Ghost text on the cursor's line when it holds something sensitive.
• Lightbulb actions to anonymize one value, a selection, or the whole file.

Highlighting is an affordance, not the enforcement point — it skips the two detectors that need an embedding call, so an unhighlighted value may still be redacted on its way out.

Anonymize and restore

Mask asks for confirmation first, and restore refuses on a masked document rather than guessing.

Commands

The anonymize/restore commands are also in the editor's right-click menu.

Scope: what @vaultline can and can't see

Built on two public, model-agnostic VS Code APIs — vscode.chat.createChatParticipant and vscode.lm. Nothing here is Copilot-specific.

It sees any model that plugs into vscode.lm, and any tool contributed via languageModelTools or native MCP support — as long as the conversation goes through @vaultline.

It does not see another extension's own chat UI that never touches vscode.lm. Assistants that ship a custom webview and make their own network calls have nothing for Vaultline to intercept, and the same is true of standalone CLI tools that talk to their provider directly. GitHub Copilot's own agent mode is not interceptable today either — VS Code exposes no public API for it.

This is a deliberate, checkable boundary rather than a claim of universal coverage: if a request doesn't go through @vaultline, Vaultline never saw it.

First run

The platform-specific builds bundle everything, including the embedding model — they work offline with no setup.

The portable build downloads the model (~23MB) and installs the server's dependencies the first time the embedding server starts. Until it's ready, routing falls back to a local hashing embedder, and detection still runs.

Set embeddingBackend to "hashing" to skip the model server entirely.

Configuration

35 settings under vaultline.*. The ones most worth knowing:

Privacy

Everything runs locally. The embedding server binds loopback only (127.0.0.1), starting at port 9000 and moving to the next free port if something else already holds it. It is started and stopped by the extension itself. There is no telemetry and no account. The audit log is a local file that, by default, records what type of thing was redacted and never the value.

Pointing embeddingApiUrl at a remote endpoint is the one way to change that, and it is opt-in.

Licensing

Apache-2.0. Bundled third-party components — including sharp (LGPL-3.0) and its vendored libraries — are listed with their licences in THIRD-PARTY-NOTICES.md inside the extension.

Source: github.com/kashyapjain123/vaultline