VaultMorph AI Shield

Overview

VaultMorph AI Shield is a desktop application that protects sensitive data when you use AI assistants. It intercepts your prompts, replaces secrets with anonymised tokens, sends the sanitized version to the AI, then restores the original values in the response — all locally, all in real time.

What gets detected and protected

Installation

System requirements

Download

Download from GitHub Releases. After downloading, verify the file: vaultmorph.org/verify →

• Windows: ai-shield-setup-x64.msi
• macOS (Apple Silicon): ai-shield-aarch64.dmg
• macOS (Intel): ai-shield-x64.dmg
• Linux (Debian/Ubuntu): ai-shield-amd64.deb
• Linux (RHEL/Fedora): ai-shield-x86_64.rpm

Quick start

1. Install using the platform installer above.
2. Launch the app. Community Edition is ready immediately — no account or internet connection required.
3. Add a provider in Settings → Providers. Choose from 10+ providers; enter your API key. The key is encrypted with AES-256-GCM and stored in your OS keychain.
4. Type or paste a message that contains sensitive data. The Findings panel shows what was detected, grouped by category and severity.
5. Press Send. The sanitized version goes to the AI. The AI's response is automatically restored so you see original values — the provider never did.

Verify your download

Every release ships with SHA-256 checksums and Ed25519 signatures. Visit vaultmorph.org/verify to check your download online, or use the CLI instructions there.

How it works

The full pipeline runs in-memory on your device:

Your text (prompt + any attached document content)
    ↓
[Detection engine] — 127 patterns across 10 categories
    ↓
[Tokeniser] — replaces each secret with a unique token
    e.g. "sk-abc123"          → "<"
         "user@company.com"   → "<"
         "4111111111111111"   → "<"
         "ABCDE1234F"         → "<"
    ↓
Sanitized prompt → AI provider (secrets replaced by tokens)
    ↓
AI response (contains tokens, not secrets)
    ↓
[Restore engine] — replaces tokens with original values
    ↓
You see the fully restored response

Attached document text is prepended to the prompt and passes through the same sanitization pipeline, so secrets inside uploaded files are also protected before reaching the AI.

The token map lives entirely in memory for the session's lifetime. Tokens are never written to disk as plaintext. Conversation history stores sanitized tokens, not raw secrets.

Detection rules

Rule severity breakdown (127 total)

Detection categories

Risk scoring

Every prompt is assigned a numeric risk score (0–100) based on the severity and number of findings detected. This score drives the colour-coded risk badge in the Findings panel.

Score calculation

Base scores per finding: Critical = 60 pts  ·  High = 35 pts  ·  Medium = 15 pts  ·  Low = 5 pts.

Diminishing returns apply when multiple findings share the same severity (×1.0, ×0.5, ×0.25 for 3rd+), preventing artificially inflated scores when the same type of secret appears many times. The final score is capped at 100.

Token format

Each sanitized value is replaced with a structured placeholder:

<<VM_TOKEN_[TYPE]_[INDEX]_[HASH2]>>

You can copy any token placeholder from the Findings panel using the ⎘ copy button next to each finding — useful when you want to paste the placeholder into another tool.

Native providers

Native providers have dedicated integration and model-list fetching.

Extended providers (OpenAI-compatible)

All extended providers use the OpenAI chat-completions wire format. Select Custom Provider in the provider selector to access them.

Subscription providers New

Subscription providers route traffic through a locally installed CLI backed by your own AI subscription — no API key required. Enable them in Settings → Subscription Models, then select them in Provider & Models.

Claude Code (Claude Pro / Max subscription)

Routes chat and Security Workspace code review through the local claude CLI using your Claude Pro or Max subscription. Requires the Claude Code CLI installed and signed in.

To enable: Settings → Subscription Models → toggle Claude (subscription — Claude Code) to ON → then go to Provider & Models and select it. The status panel shows whether the CLI was detected and its path/version.

ChatGPT (Codex CLI) Coming soon

A future adapter for routing through a Codex CLI backed by a ChatGPT subscription. Reserved — not yet available.

Azure OpenAI

Use your Azure OpenAI Service deployments as a provider. Azure OpenAI uses deployment names (not model names) and a resource-scoped base URL.

Streaming and tool calling are fully supported (same SSE wire format as OpenAI). Select Custom Provider → Azure OpenAI in the Provider & Models settings.

AI Gateways

AI gateways act as a unified routing layer in front of multiple AI providers. VaultMorph AI Shield supports two gateways out of the box, enabling features like semantic caching, load balancing, virtual keys, and observability — while still sanitizing secrets before any request leaves your device.

Portkey Gateway

Portkey is a managed AI gateway that routes to OpenAI, Anthropic, Google, and 100+ providers through a single API key. In Settings → Custom Provider, select Portkey and enter:

• Portkey API key — from your Portkey dashboard
• Config ID (optional) — a saved routing config (virtual key, fallbacks, load balancing)
• Cache mode (optional) — simple (exact match) or semantic (AI-powered similarity)

Portkey adds x-portkey-api-key and x-portkey-config headers automatically based on your inputs.

Bifrost Gateway Self-hosted

Bifrost is a self-hosted, open-source AI gateway you deploy in your own infrastructure. Enter your Bifrost base URL and a virtual key to route requests. Supports semantic caching via x-cache-mode and cost controls via virtual key budgets.

Manual (fully custom)

Select Manual to point AI Shield at any OpenAI-compatible endpoint — local models (Ollama, LM Studio), internal proxies, or any server that speaks the OpenAI chat-completions format.

Local / self-hosted models

Use the Manual provider option (Settings → Custom Provider → Manual) to connect to any locally-running model server that implements the OpenAI API:

• Ollama — http://localhost:11434/v1
• LM Studio — http://localhost:1234/v1
• vLLM — any address you configure
• LocalAI — http://localhost:8080/v1

No API key is required for local models — leave the key field blank.

Community Edition

The license is auto-generated offline on first launch. No registration required.

Pro Trial

The Pro Trial unlocks the full 127-rule pack for 6 months, free. No credit card required.

Activating your trial

1. Open Settings → License
2. Click "Start Free Pro Trial"
3. Enter your email address
4. A license JWT is issued immediately. Requires one internet connection at activation.

After activation the app works fully offline. The license revalidates every 7 days in the background when online. At trial end, the app gracefully downgrades to Community Edition — no data loss.

Enterprise License

Enterprise licenses are offline .vml files signed with Ed25519. They work with no internet connection, cover multiple seats, and can include custom expiry terms. Contact contact@vaultmorph.org.

Activating

1. Settings → License → Import License File
2. Select your .vml file
3. The app verifies the Ed25519 signature and activates immediately

Findings panel

The Findings panel appears below the message input and shows all secrets detected in your current prompt, grouped by category and sorted by severity within each group.

• Risk badge — colour-coded overall risk level (Critical / High / Medium / Low) with numeric score
• Severity counts — mini counters per severity level (e.g. "3C 2H" = 3 Critical, 2 High)
• Category groups — API Key, PII, Token, Credential, Connection String, Financial, India PII, Infrastructure, Network, Private Key
• Token placeholder — the safe token that will replace the secret in the prompt (e.g. <<VM_TOKEN_KEY_1_A3>>)
• Copy button ⎘ — copies the token placeholder to clipboard for use elsewhere
• Toggle — the panel is collapsible; it auto-expands when findings are present

When no secrets are detected, the panel shows a green ✓ No secrets detected badge instead.

Clipboard protection

When enabled, AI Shield monitors your clipboard and alerts you when sensitive data is copied — before you accidentally paste it into an AI chat window outside the application.

Enable in Settings → Advanced → Clipboard monitoring. When a secret is detected a native OS notification appears with options to sanitize, ignore, or dismiss.

File attachments

Click the 📎 button to attach files. AI Shield scans all attached content through the detection pipeline before sending.

Supported image formats

PNG, JPEG, GIF, WebP — up to 5 MB per file. Images are sent as base64 to multimodal-capable models.

Supported document formats

Text files, Markdown, CSV/TSV, JSON/JSONL, Python, JavaScript/TypeScript, HTML/CSS, XML, YAML/TOML, Shell scripts, .env, .conf, .log, Rust, Go, Java, C/C++, SQL, INI — up to 512 KB, truncated at 12,000 characters.

Document text is prepended to your message and goes through the same sanitization as your typed prompt. Any secrets inside the document are masked before leaving your device.

Remove individual attachments from the preview strip before sending, or remove them from existing messages in the message history.

Interchat context injection

Type @ in the message input to open a picker that lets you inject context from a previous conversation into your current prompt.

• Start typing after @ to filter conversations by title
• Use ↑ ↓ to navigate, Enter to select, Escape to close
• The selected conversation's sanitized content is inserted at the cursor position as a labeled context block
• The injected context passes through the detection pipeline like any other text

This is useful for chaining conversations — asking a new AI to build on analysis from a previous session — without copy-pasting large amounts of text manually.

Projects

Projects let you organise conversations into named, colour-coded groups in the History sidebar.

Creating a project

1. Click "+ New project" in the History panel
2. Enter a project name and pick a colour
3. Press Enter or click Create

Adding conversations to a project

Click the ⋮ menu on any conversation item and choose "Move to [project name]". Conversations can only belong to one project at a time.

Managing projects

• Click the ▶ toggle to collapse / expand a project's conversations
• Double-click the project name or click ✎ to rename
• Click × to delete a project (conversations are not deleted — they move to Ungrouped)
• Conversations not in any project appear under an Ungrouped label when projects exist

Conversation history

Conversations are stored locally in a SQLite database. Stored messages contain sanitized tokens, not raw secrets — your history is safe even if the database file is accessed directly.

• Auto-save — conversations auto-save 500ms after each message change
• Rename — double-click a conversation title or click ✎ to rename. User renames are preserved across auto-saves.
• Delete — click × on a conversation item to delete it
• Delete message — individual messages can be deleted from the chat (click × on a message bubble)
• Retry — if the last AI response was unsatisfactory, click the retry button to re-send the last user message
• Restore — restore original secret values in a saved conversation using the restore button in the message header

Export conversations

Export saved conversations from the conversation menu. Exported files contain the restored, readable text — not raw tokens. Secrets are always restored before export.

Export files never contain finding.match (raw secret values) or sanitizedText (token-substituted text). Only the restored display text is exported.

System prompt

Set a custom system prompt that is prepended to every conversation. Go to Settings → Advanced → System Prompt.

• The prompt is applied globally — it affects all providers and all new conversations
• Changes are saved automatically when you click away (on blur)
• Click Reset to clear the system prompt and revert to the provider's default behaviour
• If left blank, the default "You are a helpful assistant. Respond concisely." placeholder is used

Advanced parameters (Custom Provider)

When using a Custom Provider, the Advanced settings section exposes fine-grained generation controls:

Defaults are tuned per model category (chat, reasoning, code). Adjusting from defaults for native providers (OpenAI, Anthropic, Google) is not supported — use Custom Provider for that level of control.

Rule updates

New detection rules are published periodically. Rule pack updates are signed with Ed25519 and verified by the app before applying — a tampered or unsigned update is rejected and the existing rules stay active.

Pro/Enterprise: updates check api.vaultmorph.org/rules/latest automatically in the background. Trigger a manual check in Settings → Advanced → Check for rule updates.

Community: bundled rules (v2.1.0, 110 patterns) are always available offline. Rule update checks require Pro or Enterprise.

Security model

FAQ

Can I use Community Edition commercially?

Yes. Community Edition is licensed for any lawful personal or commercial use at no cost, with no restrictions.

How many conversations can I have open at once?

Community Edition supports up to 3 concurrent active sessions. Pro Trial and Enterprise support unlimited concurrent sessions.

Does the Pro Trial auto-charge me?

No. The Pro Trial is completely free and requires no credit card. At the end of 6 months the app downgrades to Community Edition. You will never be charged without explicit consent through a separate billing agreement.

Can I use free AI models?

Yes. Several providers offer genuinely free access: NVIDIA NIM (9 free models), Groq (all models free with rate limits), OpenRouter (4+ free models), and Mistral AI (open-weight models free). Select Custom Provider to access these.

Does AI Shield detect India-specific sensitive data?

Yes. Version v2.1.0 added 8 India PII rules covering PAN cards (format ABCDE1234F), Aadhaar numbers (spaced 12-digit format), UPI IDs (40+ bank handles including okaxis, paytm, ybl, upi, and more), and labeled OTP/verification codes. All are High severity.

Can I use AI Shield with local models (Ollama, LM Studio)?

Yes. Select Custom Provider → Manual, set the base URL to your local server (e.g. http://localhost:11434/v1 for Ollama), enter the model name, and leave the API key blank.

What happens if the AI returns modified token placeholders?

The restore engine uses exact token matching and a fuzzy fallback that handles common AI transformations (formatting changes, line breaks, whitespace). If a token cannot be restored it is left as-is in the displayed response.

Is the source code available?

No. VaultMorph AI Shield is proprietary software. "Free" refers to price, not source access. A full list of open-source components is at vaultmorph.org/attributions.

Can I export conversations with the original secrets visible?

Yes — exported Markdown and plain text files contain the restored, readable text (not tokens). The application restores values before writing the export file.

Custom detection rules

Beyond the 127 built-in patterns, you can add your own regex-based detection rules in Settings → Detection Rules → Custom Rules.

Creating a rule

1. Click + New rule
2. Enter a name, regex pattern (JavaScript syntax), severity (Critical / High / Medium / Low), and an optional description
3. Save — the rule activates immediately for all new messages

Custom rules use the same token format and sanitization pipeline as built-in rules. A custom-rule match produces a <<VM_TOKEN_KEY_N_XX>>-style placeholder that is restored in the response exactly like a built-in detection.

Security Workspace

The Security Workspace is a dedicated panel (separate from the chat view) for scanning code files and git diffs for secrets and vulnerabilities — without sending raw secrets to any AI provider. Open it from the toolbar icon or via Settings.

Input modes

Gitleaks secret scan

Gitleaks is an offline secret-scanning binary bundled with the app (resources/sidecars/gitleaks.exe). It scans files and diffs for committed secrets — API keys, tokens, passwords — using its rule set.

• No network calls — runs entirely offline via a local sidecar process
• Supports file content, git diffs, and folder walk modes
• Findings include: rule ID, matched line/snippet, file path, and start/end line
• All finding output (snippet, file path, description) is sanitized through the DLP gate before reaching the AI reviewer
• Bundled binary — no installation required; the Settings → Static Analysis Tools page lets you pin an alternate binary if needed

Semgrep SAST scan

Semgrep is a Static Application Security Testing (SAST) tool that finds vulnerability patterns — injection flaws, insecure crypto, path traversal, XSS, deserialisation, and more — using a curated rule set.

Installation

Semgrep has no standalone Windows binary, so it is not bundled. Install it once from Settings → Static Analysis Tools:

• Install for me — runs pip install --user semgrep and pins the path automatically (requires Python 3.10+)
• Auto-detect — finds an existing Semgrep install via the current Python's scripts directory
• Browse / manual path — pin any Semgrep executable yourself

Rule set

The app ships a bundled custom rule pack covering Go, Java, C#, PHP, Ruby, Rust, Docker/Kubernetes/Terraform, GitHub Actions, and AI/LLM-specific patterns (~150 rules). It additionally vendors a dev-reviewed, pinned-commit snapshot of the Semgrep Community Edition rule set — fetched, checksum-verified, and semgrep --validated before activation. Rule updates never come from a live moving branch.

Vulnerability categories detected

AI verdicts

After static analysis, the workspace sends the sanitized findings and (optionally) file content to your selected AI provider for a deep security review. The AI produces two outputs:

Narrative review

A structured security review with: severity, root cause, attack path (source → sink for taint-style issues), why the issue is exploitable in this specific code (not generic advice), and a concrete corrected snippet or diff. For Semgrep scans the AI maps full source-to-sink exploit paths naming actual variables and functions.

Structured verdicts

For each static-analysis finding the AI outputs a machine-readable verdict line:

VERDICT | <rule-id> | <file>:<line> | <STATUS> | ACTION: <one-line fix> | REASON: <justification>

Verdicts are parsed and matched back to findings in the UI so you can see the AI's triage decision alongside each static finding. The AI's narrative is locally restored (tokens replaced with real values) before display — the provider never saw the real values.

Send to chat

Any finding — secret or static — has a Send to chat action. This injects a pre-built prompt into the main chat so you can ask follow-up questions about a specific finding without manually copy-pasting context. The injected text is sanitized exactly like any typed message.

Folder scan

The Folder tab lets you scan an entire project directory. The workflow:

1. Choose folder — opens a native folder picker
2. File checklist — the workspace lists all scannable files (node_modules/.git/dist/build/lockfiles/binaries excluded). Select which files to include before anything runs.
3. Gitleaks scan — click Scan selected files. Secrets are found and displayed per-file with risk scores.
4. Semgrep scan (optional) — click Run Semgrep SAST. Vulnerability patterns are found across all selected files.
5. AI review queue — run AI review for all files automatically. The queue processes files sequentially so large projects aren't blocked by per-request size limits. A progress indicator shows current file and queue position.
6. Semgrep AI review (optional) — focused exploit-path analysis on Semgrep findings across the entire folder (one AI call with all findings batched).
7. Export HTML report — generates a self-contained security report (see Security report).

Scan state is persistent — switching to the chat view and back does not lose scan results or abort a running queue.

Remote repository scan New

The Remote Repo tab in the Security Workspace lets you scan a Git repository hosted on GitHub, GitLab, or any git server — without cloning it manually. The workflow is identical to the Folder scan once the repo is on disk.

Workflow

1. Enter the repo URL — e.g. https://github.com/org/repo
2. Authenticate — provide a Personal Access Token (PAT). You can save named tokens to a local encrypted vault for reuse; the vault only ever returns masked tokens — full PAT values are never read back out.
3. Select branch or tag — the app fetches the list of refs from the remote and lets you choose one
4. Clone & scan — the repo is cloned locally into a temporary directory. The file checklist appears, matching the Folder scan experience exactly.
5. Run Gitleaks and/or Semgrep, then AI review queue — identical to the Folder scan workflow
6. Cleanup prompt — after the scan you choose whether to keep or delete the local clone. The clone is never kept silently.

Supported hosts

Any git server that accepts HTTPS clone with token auth: GitHub, GitLab, Bitbucket, Azure DevOps, Gitea, Forgejo, and self-hosted instances.

PAT security

• PATs are stored in the local encrypted PAT vault (AES-256-GCM). They are only used at clone time and never transmitted to VaultMorph servers.
• The vault only returns a masked token (e.g. ghp_***abc) for display — the full value is never readable back through the UI after saving.
• The PAT itself is detected by the secret scanning rules if it appears in any scanned file, and is tokenized before reaching the AI reviewer.

Security report export

After any scan, click Export report to generate a self-contained HTML security report saved to your Documents folder. The report opens in any browser and can be printed to PDF.

Report contents:

• Cover page with report ID and timestamp
• Table of contents
• Executive summary — total findings by severity and category
• Scope and methodology (tools used, files scanned)
• Per-file findings table with file:line locations
• Detailed findings section per issue — location, problem, evidence snippet, AI-generated remediation
• AI verdict per finding (confirmed / false positive / needs review)
• AI narrative review as a closing appendix

MCP Servers Pro / Enterprise

Model Context Protocol (MCP) servers let the AI call tools you expose locally — file access, local search, database queries, code execution, or any custom tool. Two transports are supported: HTTP (loopback URL) and stdio (local process).

HTTP transport

1. Settings → Integrations → MCP Servers → select transport HTTP (localhost)
2. Enter Server ID, Display name, and loopback URL (e.g. http://127.0.0.1:8931/mcp)
3. Click + Add — registers immediately. Non-loopback URLs are rejected.

Stdio transport

The stdio transport spawns an arbitrary local process and communicates via newline-delimited JSON-RPC over its stdin/stdout — the same convention used by Claude Desktop's mcpServers config.

1. Settings → Integrations → MCP Servers → select transport stdio (local process)
2. Enter Server ID, Display name, Command (e.g. npx), Arguments (e.g. -y @modelcontextprotocol/server-everything), and optional environment variables (one per line: KEY=value)
3. Click Review… — the consent box appears showing the exact resolved command
4. Click Approve & Connect to launch and register

Managing servers

• Transport badge — each server row shows its transport type (http or stdio)
• Consent drift — if a stdio server's config changes after approval, the row shows "Launch command changed — re-approval required". Click Review to see the new command before re-approving.
• Disable / Enable — disabling an http server disconnects it; disabling a stdio server terminates the child process
• Retry — re-attempt connection for http servers that were temporarily unreachable
• Remove — unregisters the server and removes it from persistent config immediately

MCP stdio: compatible servers

Any MCP server that follows the stdio transport spec works. Common examples:

# Filesystem access
Command: npx
Args:    -y @modelcontextprotocol/server-filesystem /path/to/dir

# Everything (demo server with all tool types)
Command: npx
Args:    -y @modelcontextprotocol/server-everything

# SQLite
Command: npx
Args:    -y @modelcontextprotocol/server-sqlite /path/to/db.sqlite

The command and args format mirrors the mcpServers object in Claude Desktop's claude_desktop_config.json — if you already have servers configured there, you can use the same command/args here.

Browser Extension

The VaultMorph browser extension brings the same sanitize-send-restore protection to AI web interfaces — without needing the desktop app open. Install it in Chrome or Edge using Developer Mode.

Supported sites

How it works

• The extension injects into the AI site's input field and monitors what you type
• Secrets are detected and replaced with VaultMorph tokens before you press Enter
• The extension observes the AI's streaming response and restores original values automatically
• Uses the same <<VM_TOKEN_[TYPE]_[N]_[HASH]>> token format as the desktop app — fully compatible
• All processing is local in the browser — no data leaves the browser extension

Installation

1. Open the desktop app and go to Settings → Browser Extension
2. Click Copy to Documents to place the extension in an easy-to-find location
3. In Chrome or Edge, navigate to chrome://extensions
4. Enable Developer mode
5. Click Load unpacked and select the VaultMorphExtension folder

License sync

After activating a Pro Trial or Enterprise license on the desktop app, click Sync License to Extension in Settings → Browser Extension. This generates a one-time token you paste into the extension's License tab so it uses the correct rule set (127 rules for Pro, 110 for Community).

Document generation

Ask the AI to create Excel spreadsheets, Word documents, or PowerPoint presentations directly from the chat. The generated file is saved to your Documents folder and opened automatically.

Supported formats

Security model

Document generation uses a two-step pipeline that keeps real values off the network:

1. Your request (with secrets sanitized as normal) is sent to the AI, which responds with a structured DocGenSpec — a JSON description of the document's content using only tokens.
2. The spec is validated locally, tokens are restored in-process, and the file is rendered entirely in JavaScript (no AI-generated code is executed on your device). The real values never left.

The AI gets up to 3 self-healing attempts to produce a valid spec if the first response is malformed. The rendered file includes a watermark noting it contains real data restored from tokens.

Artifacts Pro / Enterprise

When the AI generates a self-contained HTML/CSS/JavaScript response (a chart, interactive widget, diagram, or mini-app), AI Shield renders it in a sandboxed WebView — an isolated frame that runs the content safely without giving it access to your sessions, API keys, or file system.

How the sandbox works

1. The AI's HTML/JS output is wrapped by a sandbox bootstrap before rendering — it cannot reach the parent app's DOM, localStorage, or native APIs
2. Communication between the sandbox and the app goes through a postMessage protocol with a typed message schema. The sandbox can request specific, approved capabilities (like resizing) but cannot initiate arbitrary calls
3. The sandbox origin is a dedicated local scheme — browser-origin security policies prevent cross-frame reads

Artifact types

• Charts & data visualizations — the AI can produce Chart.js, D3, or plain SVG charts based on your data
• Interactive widgets — calculators, forms, filtering UIs built as self-contained HTML
• Documents — rich formatted text, tables, or styled reports viewable inline

Artifacts appear as an expandable frame in the chat response. You can open them full-screen or copy the raw HTML source.

Knowledge Base (RAG)

The Knowledge Base lets you index your own documents so the AI can reference them during chat — without uploading documents to any server. Retrieval-Augmented Generation (RAG) runs entirely on your device.

Adding documents

• Settings → Knowledge Base → click + Add document (up to 5 MB per file)
• Or click the 📚 button in the chat input to attach and index a document in one step

How indexing works

1. Document text is chunked into overlapping segments
2. Each chunk is run through the detection pipeline — secrets are tokenized before any chunk touches disk
3. Embeddings are computed on-device from the original (pre-sanitization) text for retrieval quality; only the resulting vectors are stored — not the raw text they were computed from
4. Chunks and their embeddings are AES-256-GCM encrypted before being written to the local SQLite database

Retrieval during chat

When you send a message, the KB performs a semantic search (cosine similarity) against the chunk embeddings and prepends the top-k most relevant chunks to the prompt — sanitized, as usual. The AI answers using your private documents without those documents ever leaving your device.

Voice input

Dictate messages using an on-device Whisper speech-to-text model. Transcription runs entirely locally — no audio or transcript is ever sent over the network.

Setup

1. Download a ggml-*.bin Whisper model from Hugging Face (ggerganov/whisper.cpp). The ggml-base.en.bin model (~142 MB) is a good starting point.
2. In Settings → Voice Input, click Import model and select your downloaded .bin file
3. Once imported, the microphone button (🎤) appears in the chat input

Recording

Click 🎤 to start recording; click again to stop. The transcript appears in the chat input as if you had typed it. It passes through the same sanitization pipeline as typed text — if you dictate an API key, it's tokenized before sending.

Backup & restore

Create an encrypted backup of your settings and conversation history in Settings → Backup.

Creating a backup

1. Enter a password (minimum 8 characters)
2. Click Create backup
3. Copy the backup text and store it securely (password manager, encrypted drive, etc.)

The backup is AES-encrypted using your password. It includes settings stored in local storage. Conversation history and Knowledge Base data are stored separately in encrypted SQLite databases — back those up by copying the database files from your app data directory if needed.

Restoring

1. Go to Settings → Backup → Restore tab
2. Paste the backup text and enter your password
3. Click Restore — settings are applied immediately

Compliance Reports Pro / Enterprise

Generate de-identified audit exports of your Security Workspace findings for compliance, security audits, or SIEM ingestion. Reports contain statistical summaries and finding hashes — never raw secrets.

Export formats

Generating a report

1. Go to Settings → Reports
2. Select a date range (e.g. last 30 days, or a custom range for a specific audit period)
3. Choose format (HTML or CSV)
4. Click Export — the file is saved locally and opened immediately

What's included / excluded

• Included: finding timestamps, rule IDs, category, risk score, file path, line number, AI verdict (confirmed / false_positive / needs_review), SHA-256 hash of the secret value
• Excluded: raw secret values, decoded token content, any PII not directly part of a finding

Changelog

v1.0.0-beta (July 2026) — current

• Detection engine v2.1.0 — 127 rules across 10 categories (110 community, 17 pro-only)
• New categories — India PII (PAN, Aadhaar, UPI, OTP), Financial (credit cards, IBAN), Infrastructure (private IPs, MAC addresses)
• New API key patterns — NVIDIA NIM, Groq, xAI, Perplexity, Replicate, Resend, Razorpay, Fly.io, PlanetScale, Sentry, Slack/Discord Webhook URLs
• Risk scoring — CVSS-inspired numeric score (0–100) with severity-based calculation and diminishing returns
• Extended provider catalog — NVIDIA NIM, Groq, Mistral AI, Together AI, DeepSeek, Perplexity, OpenRouter (all with model lists)
• AI Gateways — Portkey and Bifrost with gateway header support, virtual keys, and semantic caching
• Projects — colour-coded conversation groups with collapsible sections, rename, and delete
• Interchat context — type @ to inject context from any previous conversation
• Conversation export — Markdown and plain text (all editions); PDF and JSON (Pro Trial / Enterprise)
• System prompt — global custom system prompt via Settings → Advanced
• Advanced parameters — temperature, Top P, and Max Tokens sliders for custom providers
• Message management — delete individual messages, retry last turn
• Attachment scanning — 30+ document formats scanned through detection pipeline before sending
• Stop button — cancel in-flight AI requests mid-stream
• Streaming restore — live response display with buffered token restoration on completion
• Ed25519 rule pack signing — signed updates verified before applying
• AES-256-GCM API key encryption — via OS keychain (Windows Credential Manager, macOS Keychain)
• Zero telemetry — no usage data collected in any edition
• Security Workspace — Gitleaks + Semgrep SAST, AI verdict review (confirmed / false_positive / needs_review), folder scan, remote repo scan with PAT vault, HTML/JSON export
• MCP Servers — HTTP (loopback) and stdio (explicit consent gate, Windows cmd-shim resolution) transports
• Subscription providers — Claude Code (Pro/Max plan, no API key needed; models: default/sonnet/opus/haiku); ChatGPT Codex CLI (coming soon)
• Azure OpenAI — deployment-name routing, api-key header, default api-version 2024-10-01-preview
• Artifacts — AI-generated HTML/JS rendered in sandboxed WebView with postMessage security protocol
• Compliance reports — de-identified HTML and CSV audit export (no raw secrets), date range filter, SIEM-ready
• Knowledge Base (RAG) — on-device chunking, on-device embeddings, AES-256-GCM encrypted SQLite storage
• Voice input — local Whisper (ggml), fully offline, transcript sanitized before send
• Browser extension — Chrome/Edge, ChatGPT/Claude/Gemini/Copilot, local-only processing
• Document generation — Excel/Word/PPTX via structured DocGenSpec, no AI code execution
• Remote repo scan — HTTPS+PAT clone, PAT vault (AES encrypted, masked on readback), branch/tag selection