Mask secrets and PII before Claude Code or Codex sends them

Reddit r/AI_Agents 07/29/26, 11:20 AM Tools

security privacy pii-masking secrets-management claude-code codex dev-tool

Summary

A developer built Hamza, a tool that inspects outbound requests from AI coding agents like Claude Code and Codex to mask secrets and PII before they leave your machine.

Solo builders move fast because there is no security team. That is also the risk. A coding agent can read your .env, application logs, database exports, and customer files and include parts of them in a normal request to Anthropic or OpenAI. I built Hamza to inspect that final outbound request and mask detected secrets and PII before it leaves your machine.

Original Article

Similar Articles

I tricked Claude into leaking your deepest, darkest secrets

Hacker News Top

A security researcher demonstrates a method to trick Claude AI into exfiltrating user personal data from its memory system by encoding data in web fetch URLs, exploiting the combination of memory retrieval and web browsing capabilities.

How I tricked Claude into leaking your deepest, darkest secrets

Simon Willison's Blog

A security researcher discovered a vulnerability in Claude's web_fetch tool that allowed data exfiltration by chaining through nested links, compromising user privacy. Anthropic has since fixed the issue.

Breaking Claude Code Opus 5 Auto Mode

Simon Willison's Blog

A researcher discovered an attack that bypasses Claude Code's auto mode with 80% success, exposing risks in AI safety mechanisms and advocating for sandboxing.

If you're new to coding agents: they keep a diary, and your API keys are in it

Reddit r/AI_Agents

Coding agents like Claude Code, Cursor, and Codex save session logs locally, potentially exposing sensitive data like API keys and environment variables. A developer named Ishan created an offline tool to scan and redact secrets from these logs, addressing a common security blind spot.

Secret Claude tracker shocks users after Anthropic’s anti-surveillance stance

Ars Technica

Anthropic secretly embedded a hidden tracker in Claude Code to monitor Chinese users, using prompt steganography, contradicting its anti-surveillance stance and sparking user trust concerns.