I don’t get why everyone treats secret leaks like normal everyday bugs. Am I being paranoid?

After the recent Anthropic leaks mess I looked up the actual fallout of a single secret leak. Its insane. There was an Uber breach started with one AWS key left in repo.

Attackers used it to steal 57M peoples data and It cost Uber a $148M settlement and their ciso was convicted in federal court.

This month CISA, a US agency in charge of cybersecurity had left admin keys to three government cloud accounts in public repos that were online for months with plaintext passwords and some keys were still live two days after they were already notified.

Anthropic leaked Claude Codes own 500k-line source code and then Lakera and Check Point discovered that hitting "allow always" once caches entire terminal commands-keys included, in a local settings file, and because npm packages publish everything by default, dozens of real active keys and tokens are sitting public right now through Claude.

I got paranoid, so i built a fully free wrapper that fixes this. Just run shutapp claude instead of claude. it catches secrets (200+ types) before they leave the machine, swaps them for placeholders, keeps the real values in your files locally. Claude sees <STRIPE_KEY>, your code keeps the real one. nothing gets out from your local computer to any server.

thought it would be useful for most of you

just run pip install shutapp

then to run claude code with the wrapper in terminal run

shutapp claude

it is fully free, repo in comments.