blind is a local proxy. It sits between your agent and the API, swaps every name, key and hostname for a stand-in on the way out, and puts your real ones back in the reply. The model gets working code and never learns whose it is.
the blind closes · identity changes · every line of logic is byte-identical
If the model never sees your code, it cannot help with your code. blind draws the line somewhere more useful.
Control flow, algorithms, structure, library calls. This is what the model needs to reason, and it is rarely the secret.
Company and product names, clients, credentials, hostnames, database names. Never leaves the machine.
Answers come back carrying your real names, so the advice applies and the patch actually lands.
You should not have to type out everything that identifies you. blind works most of it out.
Wrap any command and its output is replaced before it reaches your terminal, scrollback or CI log. Buffered by line, so a secret split across two chunks cannot slip through.
Secrets written to your transcripts before blind existed. Reports by default, rewrites only when asked, keeps a backup, and never leaves invalid JSON behind.
Scans the working tree and exits 1 on a finding, so a build can fail before a key is merged. Values are masked in the output, because a CI log is public.
Masking can fail quietly, or the model can infer a name and say it out loud. If a real value comes back in a response, blind flags it instead of letting it pass unnoticed.
Data pulled from Slack, GitHub or a warehouse through an MCP server reaches your context the same way a file read does, and a network proxy cannot see it. The hook scrubs it too.
Installs two hooks. Tool output is scrubbed before it enters the transcript, and files matching a deny rule are refused before they are even opened. No env var to remember, and it reaches the session log on disk that a proxy never can.
Four categories, four strategies each. mask swaps for a stand-in, deny refuses the request outright, warn lets it through and records it, off ignores it. Pick per category, or start from a profile.
Checks the one thing people get wrong: whether your agent is really pointed at the proxy. Plus terms, policy and deny rules, so a silent no-op cannot masquerade as protection.
Package name, git org, README title, and the capitalised names that recur in your source. Anything on an import line is skipped, because that identifies a library, not you.
Some things should never leave under any disguise. Matching content is rejected at the proxy with a 403 and never reaches the network.
Emails, IP addresses, internal hostnames and bearer tokens, on top of every key and connection-string format.
Add regex patterns for the things only your team has: ticket ids, internal service names, customer codes.
Reads the audit log and reports how many values stayed home, broken down by rule, plus anything refused outright.
Anthropic, OpenAI, Gemini and OpenRouter presets, or point it at any upstream you run yourself.
Substitute opaque tokens and the model loses track of what it is looking at. A key stays key-shaped.
honesty
It cannot promise nothing escapes. It promises you see everything that leaves.
No tool can guarantee the first. One novel secret format or one prompt injection breaks an absolute, and security software that overclaims gets people hurt. The fear was never really the leak. It was not being able to look.
Already ran an agent without a barrier? spilled reads your existing logs and reports what has already gone out.