Sidecar Sieve — Flag Secrets & PII Before You Send to AI

Pauses your send to ChatGPT, Claude or Gemini to flag labelled secrets, API keys, card and ID numbers, and personal details.

Sidecar Sieve checks the text you're about to send to ChatGPT, Claude or Gemini, on your device, and pauses the send so you can see what it found. Your first message after installing can pause for up to 45 seconds while the detection model starts downloading. Nothing is sent until that check finishes: if the model isn't ready yet, Sieve tells you only the pattern check ran and asks before sending. WHAT'S NEW IN 1.1.0 On 2,385 test messages we wrote to probe its weak spots, the number that sent something it should have removed fell from 1,672 with 1.0.4 to 44 with 1.1.0 (Detailed review, default settings). It looks for: - passwords and secrets that have a name next to them - API keys in known formats - card numbers, IBANs and ID numbers - email addresses, phone numbers, IP addresses and postal addresses - dates written as 14 March 1988, March 14, 1988, 1988-03-14 or 03/14/1988 - once its on-device model has finished setting up, names, employers, and dates of birth written in other ways (such as "born in 1988") This flags supported patterns — it isn't a guarantee that everything sensitive will be caught. WHAT HAPPENS WHEN YOU PRESS SEND What happens depends on the review mode you choose in the toolbar popup. Detailed review (the default). A panel lists each item found. - Keys, passwords, and card numbers, IBANs and ID numbers are pre-selected for removal and locked. - Email addresses, phone numbers, IP addresses and postal addresses are pre-selected, and you can untick them. - Names, employers and dates are listed unticked, for you to decide. "Send with redactions" replaces the selected items with labels such as [CREDENTIAL]. "Send original" sends your text unchanged. After "Send with redactions", Sieve checks whether a removed key, password or address continues into the text right next to it. If it does, it asks before removing that text too. The prompt says how many characters it will remove, and shows them only when they're clearly a short word such as "-fix". "Remove and send" removes them; "Cancel" sends nothing. If the extra text is too long to remove safely, Sieve sends nothing and tells you so. Sometimes Sieve can't confirm the removal worked, for example with some XML, a very long key, or text that already contains labels such as [ADDRESS]. Then it sends nothing and tells you why. Warn only. Nothing is ever removed. You're told how many items were flagged, but not which ones, and asked whether to send your message exactly as typed. If nothing is found, in either mode, your message is sent straight away without a prompt, unless the model is still setting up or part of the message can't be read (both described below). That includes a message containing a secret Sieve doesn't recognise; see "What it can miss" below. THE FIRST FEW MINUTES AFTER YOU INSTALL The on-device model that finds names, employers and dates is not downloaded until you send your first message. It then needs to download and pass its integrity check, which usually takes one to four minutes after that first send and longer on a slow connection. Until the model is ready: - Pattern detection runs. Keys, passwords, card numbers, IBANs and ID numbers, email addresses, phone numbers, IP addresses, US, UK and French postal addresses, and dates in the forms listed above are caught as usual. - Names, employers, and dates of birth written in other ways (such as "born in 1988"), are not detected at all. - Each send pauses for up to 45 seconds on "checking…" before you see the result. If pattern detection found something, the review panel says the model is still loading and that names, employers and some dates weren't checked. If it found nothing, you're asked "The on-device model is still loading, so only the pattern check ran — it found nothing. Send anyway?". - The badge says so. Until your first message it reads "no scan run yet this session" (nothing is downloaded before then). While the download is in progress it reads "model still loading — pattern check only for now". The badge turns green ("armed") within about half a minute of the model being ready. The download happens once per install, and again only if the browser clears the extension's stored data. If the download fails or the connection drops, the badge changes to "NOT ARMED (model verification failed)" within about half a minute. If the connection to Hugging Face stalls without failing, the badge can stay on "model still loading" until it recovers or fails; the pattern checks above keep running throughout, and names, employers and other date-of-birth phrasing stay undetected until the model is ready. WHAT IT CATCHES Everything in this list is subject to the limits under "What it can miss" below. The exact names, formats and key prefixes Sieve recognises are listed at https://sidecar-tools-site.vercel.app/sieve/detects.html - Secrets with a name next to them on the same line, where the name ends in one of the recognised words, such as password, secret, token or API key (for example db.password or api_key_v2). Common config, code and command-line formats are recognised. The full lists of names and formats are on the page above. - Private keys in PEM format. - API keys and access key IDs from major AI, cloud, developer and payment services (such as OpenAI, Anthropic, GitHub and Stripe), recognised by their standard prefix, even with no name next to them. Only the services and prefixes on the page above are recognised. - JSON Web Tokens, the value of an Authorization: Basic or Bearer header, and common database and web links that contain a password (postgres://user:pass@host). The supported link types are on the page above. - Financial and ID numbers: - US Social Security numbers written as 123-45-6789; UK National Insurance numbers written without spaces (QQ123456C); IBANs; card numbers of 13, 15, 16 or 19 digits that pass the Luhn check - passport numbers written as a letter, 7 digits and a 3-letter country code - Contact details: - email addresses - phone numbers in US, UK and Australian formats - IP addresses - US, UK and French postal addresses - Dates in these forms: 14 March 1988, March 14, 1988, 1988-03-14, 03/14/1988. They are listed for you to decide. Any such date is treated as a possible date of birth. - Names, employers, other date-of-birth phrasing, and addresses outside the US, UK and France, found by the on-device model once it is ready. These can be missed, especially unusual names. WHAT IT CAN MISS These go out without a prompt, or, where it says so, with the panel showing the item as removed. Addresses - A city followed by a bare postal code, with no state, can slip through even when the panel shows the address as removed. - Addresses written in unusual ways (a unit such as "#4" on the street line, "Calif.", a blank line inside the address, a lowercase postcode) can be partly sent even when the panel shows the address as removed. - A bare place with no street, such as "Austin, Texas", is not detected. Passwords and keys - A secret with no name next to it on the same line is not detected unless it has a recognised prefix, for example a random API token, a cloud secret key or the signature in a signed storage link. A secret whose name is on the line above it is missed too. - A password written in a sentence, such as "my password is …", rather than as name: value or name=value, is not detected. - Passwords that are a single plain word or contain a space are not detected unless the value is in quotes (password="correct horse"). Quotes don't help with values under 3 characters, common placeholder words, or field names Sieve doesn't recognise. - A password that is a common placeholder word, such as changeme or none, is not detected, and neither is a field named just pass (DB_PASS and --pass are caught). - A secret written after the word "secret" with no "=" or ":" is not detected. - Some keys from the services above aren't detected at all when they're in less common forms: some newer or less common key types, unusually short keys, some keys with an underscore after the prefix, and keys joined to the text in front of them. The page linked above lists exactly which. - A key broken across two lines can have its second half sent. - A password that starts like one of the recognised access key IDs, with more text after a hyphen, can have that text sent. ID and financial numbers - Social Security and National Insurance numbers written with spaces or no dashes, and bank account, sort code and routing numbers (only IBANs are detected). Names and dates - Names, employers, and dates of birth not written in one of the date forms above, before the on-device model is ready, and sometimes after. WHAT IT CAN REMOVE BY MISTAKE - After an address, a reference such as "Order 20931" or "Order ID 20931", on the same line or the next, can be partly or completely removed along with the address. - In configuration text, words such as "region" or "eu" next to a credential can be mistaken for part of an address and removed. - A password or other value typed directly against punctuation, with no space after it (password=abc,then), can take the next word with it. A word joined to a key by a hyphen (-fix, -v2) can be removed after a prompt. - If you untick an item that sits directly next to a key, the extra check can still remove it after a prompt, and the prompt doesn't say it's the item you unticked. PARTS OF YOUR MESSAGE IT CAN'T READ Sieve reads the text in the message box. It can't read inside file attachments, images, or large pasted blocks that the chat site turns into an attachment. When one of these appears as an attachment in the message box, Sieve warns you as long as it still recognises that site's current layout: - the badge turns amber, - you're asked to confirm before it sends. A chat site redesign can stop this warning working until Sieve is updated. Sieve does not detect or warn about voice conversations or dictation features. EVERYTHING RUNS ON YOUR DEVICE No accounts and no analytics. Sieve never transmits your text anywhere: - Detection runs locally in your browser. - Settings stay on this device. They are stored locally and are not synced to your Google account. - The only network requests while it runs are the one-time download of the detection model and its tokenizer from Hugging Face. Those files are checked against fixed SHA-256 hashes, and refused if they don't match. - The only other thing Sieve sends is two facts when you uninstall, described under "On uninstall". PER-SITE CONTROL Turn Sidecar Sieve off for any of the three sites in the toolbar popup, and back on the same way. While it's off for a site, the badge there reads "off for this site" and nothing you send on that site is checked. THE BADGE A small badge above the message box shows Sieve's state: - armed (green) - checking… - no scan run yet this session - model still loading — pattern check only for now (purple) - off for this site - pasted content not checked (amber) - NOT ARMED (model verification failed) (amber): the model could not be downloaded or verified, or the on-device engine was lost - NOT ARMED (composer not found) (red) ON UNINSTALL If you remove the extension, Chrome opens a short feedback page. It receives two things: the extension version and how many days it was installed. There is no identifier, no account, and nothing you ever typed or scanned. The form itself is optional and asks for no personal details. PERMISSIONS - offscreen: runs the detection model separately from the pages you visit - storage: saves your settings and the install date, all on this device; the install date exists only for the uninstall page - scripting: turns on protection in chat tabs you already had open when you installed - chatgpt.com, claude.ai, gemini.google.com: the three sites it runs on - huggingface.co and hf.co, including their subdomains: the model download It does not request access to your browsing history, your identity, or any site other than the three chat sites and the Hugging Face model host.