Veilpipe is open source. Your coding assistant never sees the value it replaced.

When you debug a payment or a login with a coding assistant, the key tends to end up in the conversation. You paste it into a prompt, or the assistant runs cat .env, or a tool prints a connection string. Whatever reaches the conversation is sent to the model provider.

Today we're releasing Veilpipe, open source under Apache-2.0. It is a mod for Claude Code, and a plugin for opencode, that replaces secrets with names on your own machine before the model sees them.

The problem

A settings hook can block a prompt that contains a key. That stops the leak, and it also stops your work. What you usually want is different: let the assistant keep going, just without the value.

What we built

Veilpipe sits on every path text takes to the model: what you type or paste, what tools return, and files you attach. When it finds a secret, it replaces it with a stable name such as $STRIPE_KEY. The same value always gets the same name, so the assistant can still reason about "the Stripe key" without ever holding it.

In Claude Code it also keeps its own store (not yet in opencode). Keys you type or paste, and your own .env or environment, are saved under their names, encrypted per project, so a later command that uses $STRIPE_KEY gets the real value when it runs, in the same session or a new one, while the model only ever sees the name. Two different values with the same kind of name stay apart ($DB_PASSWORD, $DB_PASSWORD_2). Keys found in a README, docs or code are still hidden from the model but not saved. Auto-save can be turned off. The store is tested on Linux and on macOS, where the key lives in the Keychain.

How it works

1. Catch. It hooks the paths into the model: prompts, tool output, and text the engine injects.
2. Replace. 232 patterns, 217 of them from the gitleaks ruleset, turn each secret into a name.
3. Check. veilpipe doctor --canary sends a fake key through a real session and confirms the model only saw the name. The 65-second demo on the page runs this for real.

It makes no network calls of its own.

What it does not do

Read this part before you install it.

• It guards what the model sees, not what is already on disk. Secrets written to transcripts or logs before you installed it, or in sessions run without it, are still there. veilpipe audit lists them by name and count, never by value.
• It matches shapes, not meaning. A secret with no recognisable shape is not replaced.
• Text the model writes itself is stored as written, for example a password it invents for a new .env.
• The store widens what one bad command can reach. A prompt-injected command could use every value stored for that project, and a value sent over the network is outside Veilpipe's sight. If that trade-off is wrong for you, turn auto-save off.
• Mods are not sandboxed. Read the install script before running it; the page links it and shows its checksum.

What we learned building it

Blocking was never the hard part; a settings hook can already do that. The hard part was letting the work continue: rewriting the text on the way to the model, keeping names stable so the assistant can still reason about them, and then getting the real value back into a command without the model ever holding it. Each of those steps also adds a trade-off, which is why the limits above are part of the release, not a footnote.

Try it

Page, demo and install: https://veilpipe.deemwar.com