DLP Guard — Prompt Firewall for AI

Hides secrets, API keys, and tokens on web pages and redacts pastes. 100% local. Never runs on login or registration pages.

Don't let a secret slip into a chatbot. It's easy to paste an API key, a private key, or a whole .env into ChatGPT or Claude without thinking, or to drag in a CSV that's full of customer emails. Once it's sent, it's on someone else's server. DLP Guard catches it first. It watches three moments where data leaks: Paste — when you paste into any chat box or input, secrets are replaced with a readable mask (ASIA••••FSPM) before the text lands. Need the original? One click puts it back. File upload — attach or drag a file into an AI tool and DLP Guard scans it first. If it finds keys, private certs, or a bulk list of personal data, it warns you and can remove the file from the upload — even on apps like claude.ai that hold files in memory. On the page — secrets already shown on a page get masked in place, so a screenshot or a shared screen doesn't expose them. What it recognizes: cloud keys (AWS, GCP, Azure), OpenAI, Anthropic, GitHub, Stripe, Slack and hundreds of other token formats, -----BEGIN PRIVATE KEY----- blocks, connection strings, and — when you turn it on — personal data like emails, phone numbers, SSNs, and credit cards in spreadsheets and exports. Over 780 built-in patterns, all editable, and you can add your own. Private by design. Everything runs on your device. DLP Guard makes no network requests, has no account, and collects nothing — the detection never leaves your browser. It also stays completely out of the way on login, password, and registration pages, and inside document editors like Google Docs. Yours to tune. A full settings page lets you switch detections on or off, edit any pattern, add protected terms (your company's server names, client names, project codenames), set a max file size, choose warn-vs-block-vs-auto-remove, and export or import your whole config as YAML.