Sieve: API Key & Secret Finder

Sieve scans your AI coding assistant history for accidentally leaked secrets - API keys, tokens, passwords, and private keys - before they cause damage. If you use Claude Code, Cursor, VS Code Copilot, Windsurf, or Codex, your chat history may contain secrets you pasted into prompts or that appeared in autocomplete suggestions. Sieve finds them. WHAT SIEVE SCANS • Claude Code (~/.claude/) • Cursor (Application Support/Cursor/) • VS Code Copilot (Application Support/Code/) • VS Code Insiders (Application Support/Code - Insiders/) • Windsurf (Application Support/Windsurf/) • Codex (~/.codex/) • .env files in your project directories VAULT - SECURE SECRET STORAGE Found a leaked key that you've already rotated? Store the new value in Sieve Vault - backed by macOS Keychain. Values are never displayed. Copying a value requires Touch ID or your Mac login password. MCP INTEGRATION Sieve ships with a local MCP server for Claude Code. Enable it in Settings to let Claude check for exposed secrets, query your findings, and run commands with vault-injected credentials - without ever seeing raw secret values. REDACTION Sieve can redact detected secrets directly from VS Code SQLite chat databases (.vscdb files). A timestamped backup is created before any changes. PRIVACY BY DESIGN • 100% local - no network requests, no cloud sync • No account required • No telemetry or analytics • Findings stored in local SQLite database • Secrets stored in macOS Keychain only - never in the database • Open source core (SieveCore) PERMISSIONS Sieve uses macOS security-scoped bookmarks to access AI tool directories. On first launch, you grant read access to each tool's folder via a standard Open dialog - the same permission mechanism used by all sandboxed Mac apps. You are never asked again after the initial grant. Sieve is built for developers who take secrets hygiene seriously. Terms of Service: doesn't exist yet - https://gautam-u.github.io/sieve/terms/ Privacy Policy: https://gautam-u.github.io/sieve/privacy/