API Key Leak Intercept

Stop pasting API keys into AI chats. Warns you before a secret or personal data leaves your browser. All detection runs locally.

You pasted an API key into an AI chat to debug an error. The key is now in someone else's logs. Bots scrape leaked keys within hours and the bill lands on your card. API Key Leak Intercept sits between your clipboard and every AI chat. When a secret is about to leave your browser, a modal stops it and asks what you want to do. That moment before send is where API key leak prevention has to live. For a team, the same guard becomes browser data loss prevention with an audit trail behind it. FOR TEAMS AND IT: Every employee with an AI chat window open is one paste away from leaking an API key, a token, or customer data. Traditional data loss prevention does not watch the AI chat box. This does, and it is the guardrail you deploy once and manage from the console. • Force-install through Chrome Enterprise Policy (Group Policy, MDM, or the Chrome Enterprise Console). Employees cannot uninstall it, and you can lock the settings so the policy holds. • Live alerts wherever your team already works: chat tools, email, or any webhook your SIEM listens on. Each alert tells you who triggered it, which site it happened on, what kind of secret was involved, how serious it was, and whether the warning was heeded or overridden, with a timestamp attached. Security and compliance teams get evidence instead of noise. • The secret itself and the message text never leave the browser. Your team gets leak prevention and oversight without reading anyone's conversations. • A heartbeat tells IT which installs are alive, and the cloud IT dashboard keeps the last 500 alerts per organization behind an admin key. • One setup code configures the organization ID and the security policy in a single paste. Deployment guides and MDM configuration are public, and managed install detection works out of the box. • Universal mode extends scanning past the AI chat list to every website in the browser, for teams running custom web tools and internal apps. • Team licensing is per seat, and a seat is one installed machine. The IT dashboard shows seats in use against seats bought, and the License & Team Console is where you add more. WHAT'S NEW IN 1.3.1: JSON configuration is now read the way a .env file is, so a password or a token key inside a JSON block is caught before it leaves. Secrets written in base64 are recognised whatever characters sit at either end. Identity numbers typed in lowercase are caught as reliably as capitals, and placeholder numbers in the shape of real ones do not raise a warning. Team seats follow the installed machine and include machines that report through alerts. Auto-redact sends only once the redaction has reached the editor's own text, and the warning dialog masks the preview of what it found. WHAT IT DETECTS: • API keys and tokens: the major AI providers, cloud platforms, code hosts, payment gateways and messaging tools, plus JWTs, Bearer tokens, PEM private keys, generic key=value assignments, and long high-entropy tokens. • Personal data (Pro): email addresses, phone numbers, credit and debit cards, IP addresses, and national identity numbers for 30 countries (US SSN, Italian codice fiscale, Mexican CURP, and more). • Custom regex patterns (Pro) for internal secrets, tokens, and identifiers. HOW IT WORKS: 1. Type or paste a message into an AI chat. More than 40 AI chat and work tools are covered. 2. Press Enter or click Send. 3. If a secret is detected, a modal appears with Cancel, Send anyway, and Redact (Pro). 4. Messages without secrets pass through untouched. Redaction (Pro, or on when auto-redact is enabled) replaces secrets with typed placeholders like [API_KEY_1] in the input before the message is sent. PERSONAL MODE (FREE): • Detection runs locally in your browser. Message content and secrets are never transmitted. • Free covers API key detection, and it warns on every secret it finds. There is no monthly cap on the free plan. • Settings, counters, and the audit log stay in chrome.storage.local in your browser profile. PRO MODE ($7.99/month or $59/year): • PII detection (emails, SSNs, credit cards, phone numbers, IP addresses, national IDs for 30 countries). • Custom regex patterns. • One-click redaction (replace secrets with typed placeholders like [API_KEY_1] before sending). • Local warning history. NETWORK REQUESTS: • License verification against our backend, only when a Pro license key is stored (on entry, on popup open, and once a day). • A signed daily config fetch from our worker (site lists only; carries no message data and never changes the detection rules). • Team mode only: a daily entitlement check (org ID and token), an opt-in six-hourly heartbeat (org ID, user email, extension version, timestamp), and alert metadata to the channels the IT admin configures. • No analytics, no trackers, no remote fonts. The popup's fonts ship inside the extension. PERMISSIONS: • storage: save settings, the monthly leaks-stopped counter, and the audit log locally. • alarms: daily license revalidation, signed config fetch, and the team-mode heartbeat. • scripting: registers the content script at runtime for admin-added sites and Universal mode. • Host access: the AI chat and work tool sites the extension is built for, listed in the manifest. • <all_urls> (optional): asked for only when Universal mode is turned on, or when an IT admin adds sites of their own. Declining keeps the extension on the AI chat sites. SELLER AND TERMS: Sold by Dario Cositore, an independent developer. Google is not the seller and is not a party to the payment. Payments run on Waffo Pancake's checkout, with PayPal available as a fallback. Terms of sale, refunds and the 14-day money-back guarantee: https://dariocositore.com/terms/ PRIVACY: Full privacy policy: https://dariocositore.com/tools/api-key-leak-intercept/privacy/ OPEN SOURCE: Full source on GitHub: https://github.com/dario-cositore/api-key-leak-intercept (MIT license) SUPPORTED SITES: More than 40 AI chat and work tools, from the biggest AI assistants to developer platforms, all listed in the manifest. The full inventory is published on the coverage page: https://dariocositore.com/tools/api-key-leak-intercept/coverage/