How to detect secrets and sensitive data before pasting them in your browser

Your clipboard contains whatever you copied last — including content that wasn't the focus of your attention. A paste that takes a quarter of a second can send credentials, connection strings, or private keys out of your control.

How to detect secrets manually

Before pasting into any AI chat or form, scan for known credential prefixes: sk- (OpenAI), sk-ant- (Anthropic), AKIA (AWS), ghp_ (GitHub), glpat- (GitLab), pk_live_/sk_live_ (Stripe), SG. (SendGrid), xoxb-/xoxp- (Slack), and PEM private key headers. Also look for context labels like api_key=, secret_key=, access_token=, and DATABASE_URL followed by a value.

How local, pre-submission detection works

ShieldVault is a Chrome browser extension that runs pattern matching inside your browser tab before you submit. When it detects a recognized credential pattern, it redacts just the secret, tells you what was caught, and gives you an undo window. All of this happens locally — inside your browser tab, before the text is submitted. Your content is not transmitted to ShieldVault's servers for analysis. Detection without possession: the extension identifies the credential on your device and nowhere else.

What happens when something is caught

• Surgical redaction: only the detected credential is removed, surrounding context stays intact.
• A notification tells you the category caught and where in the text it was found.
• An undo window lets you restore the original content.
• An allow-once option lets you proceed after deliberate review.