safekeys

When developers paste a password or API key into an AI coding assistant, it can end up stored in chat logs and history. safekeys locks the key in the computer's own secure keychain, so the assistant only ever sees a placeholder name.

If a key can't be locked away safely, the message isn't sent at all.

For developers

A Claude Code plugin. Type a key once with $: in front of it: the value goes to the OS keychain (macOS Keychain, or secret-tool on Linux) and Claude works with the name. If a key can't be stored safely, the prompt is dropped before it is sent.

> $:STRIPE_KEY=sk_live_51Hq8xT2c add this to .env
  safekeys: STRIPE_KEY saved to the macOS Keychain

  what Claude sees:
> $STRIPE_KEY add this to .env

  Bash(cat .env)
  STRIPE_KEY=$STRIPE_KEY
  the real value never reaches the model

Latest releases

• 0.5.2Stopped hooking prompt.attachment
• 0.5.1Leaves Ruby's $: load path alone
• 0.5.0Asks about a bound key only for a destination the command shows
• 0.4.1Checks a resent command without safekeys' own helper line

Install

/plugin install safekeys@pravnyadv