LeakGoblin

The funny, genuinely useful open-source AI-prompt security CLI. The goblin guard that protects your secrets before you paste into ChatGPT, coding agents, or issue trackers.

Try Live Playground Quick Start Guide
Core Promise

Scan locally → Redact sensitive-looking values → Review before sharing.
100% offline security with zero cloud uploads, zero subscriptions, and zero telemetry.

Quick Start

Run LeakGoblin instantly with npx or install it globally via npm:

# Scan text before pasting to AI
cat prompt.txt | leakgoblin scan --stdin
echo "api_key = AKIAIOSFODNN7EXAMPLE" | leakgoblin scan --stdin

# Get sanitized version safe to share
cat prompt.txt | leakgoblin sanitize --stdin > safe_prompt.txt

# Scan a repository directory
leakgoblin scan .
leakgoblin scan . --format json > report.json

# CI Mode (exit 1 if secrets found)
leakgoblin scan . --quiet
echo $?  # 0 = clean, 1 = secrets found, 2 = error

Installation

System Requirements: Node.js >= 20.0.0 (Recommended: Node 24 LTS / Node 22 LTS).

Package Manager Global Installation Command
npm npm install -g leakgoblin
yarn yarn global add leakgoblin
pnpm pnpm add -g leakgoblin
bun bun add -g leakgoblin

Installing From Source

git clone https://github.com/lovixcloud/leakgoblin
cd leakgoblin
npm install
npm run build
npm link
leakgoblin --help

Verifying Installation

leakgoblin --version
echo "test AKIAIOSFODNN7EXAMPLE" | leakgoblin scan --stdin

Interactive Secret Playground

Test LeakGoblin's secret scanner and sanitizer in real-time right here in your browser! All processing runs client-side inside this webpage.

What LeakGoblin Detects

LeakGoblin scans text using format-specific signatures and conservative heuristics. Findings are never logged in raw form.

Category Pattern / Target Examples Severity Confidence
Private Keys -----BEGIN RSA PRIVATE KEY----- Critical High
Cloud Credentials AWS AKIA..., aws_secret_access_key Critical / High High
API Keys GitHub (ghp_), Stripe (sk_live_), Slack (xoxb-), Google (AIza...), OpenAI (sk-...) Critical / High High / Medium
Bearer & JWT Authorization: Bearer ..., eyJ... High / Medium Medium
Passwords password = "...", passwd: ... High Medium
Database Strings mongodb://, postgres://, mysql://, redis:// Critical High
Environment Vars GITHUB_API_KEY=..., *_SECRET=... High High
Heuristics 32+ character high-entropy random strings Low Low

Interactive Configuration File Generator

Customize detection thresholds, ignore rules, and custom regex rules by building your leakgoblin.config.json:

Configuration Discovery Order

LeakGoblin automatically resolves configuration files in the following hierarchy:

  1. Custom path explicitly provided via --config <path>
  2. leakgoblin.config.json in the current directory or parent directories
  3. .leakgoblinrc.json or .leakgoblinrc
  4. Built-in defaults

CLI Command Reference

leakgoblin scan [target]

Scans stdin, a file, or a directory for sensitive credentials.

OptionDescription
--stdinRead input directly from standard input
--format <text|json>Output formatting (default: text)
--exclude <patterns...>Additional path exclusion patterns
--verboseShow skipped files and diagnostic messages
--config <path>Specify custom configuration file path
--no-colorDisable terminal ANSI colors
--quietQuiet mode for CI (suppresses stdout, relies on exit code)

leakgoblin sanitize

Reads stdin and outputs a redacted version where all detected secrets are replaced with [REDACTED:CATEGORY:RULE_ID].

OptionDescription
--stdinRead input from stdin (default)
--no-summarySuppress summary line printed to stderr
--config <path>Specify custom config file path

Exit Codes

  • 0: Clean — No secrets detected or sanitize succeeded.
  • 1: Secrets Found — Scan detected suspicious secrets.
  • 2: Error — Invalid config, file missing, or stdin exceeded size limit.

Security & Local-First Model

🛡️ Goblin Security Principles
  • Local-only Execution: Zero network requests, zero telemetry, zero analytics.
  • Safe Logging: All findings mask secrets (e.g. AKIA...LE). Raw secret values are stripped before JSON output.
  • Synthetic Canary Values: All internal unit tests use fake canary credentials (e.g. AKIAIOSFODNN7EXAMPLE).
  • Best-Effort Filter: Signature matching is conservative; always perform manual review before sharing sensitive logs.

Troubleshooting Guide

stdin too large (>10MB)

For stdin safety, inputs above 10MB are blocked. Use file scan mode instead: leakgoblin scan ./large.log or adjust maxFileSizeMB in config.

False Positives on High Entropy Strings

Generic high-entropy strings carry severity: low and confidence: low. Raise threshold in your config: "confidenceThreshold": "medium" or add pattern to allowlist.

Terminal Colors Not Rendering

Ensure your terminal supports TTY colors, or pass --no-color in script pipelines or CI environments.

Contributing & Architecture

LeakGoblin is written in TypeScript using ESM module architecture:

src/
  cli.ts           # Commander CLI entrypoint & fallback parser
  commands/        # Subcommands (scan, sanitize)
  engine/          # Rules database, detector, redactor
  config/          # Config file loader & schema validation
  utils/           # File system traversal, input buffering, masking
  reporting/       # Terminal formatters & JSON exporters
tests/             # Vitest test suites

To run unit and smoke tests locally:

npm test
npm run smoke

Support & Sponsorship

LeakGoblin is 100% free and open-source under the MIT license. If LeakGoblin saved you from a suspicious copy-paste, consider sponsoring or tossing the goblin a coffee!

Disable sponsorship notices in CLI by setting LEAKGOBLIN_NO_DONATION=1 in your environment.