GitHub - sarthakuwar/aileaks: Scan repos/logs for LLM provider reasoning-trace leaks (Anthropic/OpenAI/Google encrypted CoT blocks) · GitHub

/" data-turbo-transient="true" />

Skip to content

Type / to search

Sign in<br>Sign upAppearance settings

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

sarthakuwar

aileaks

Public

Notifications<br>You must be signed in to change notification settings

Fork

Star

master

BranchesTags

Go to file

CodeOpen more actions menu

Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit

History<br>4 Commits<br>4 Commits

.github/workflows

.github/workflows

src

src

.gitignore

.gitignore

CONTEXT.md

CONTEXT.md

LICENSE

LICENSE

README.md

README.md

action.yml

action.yml

package-lock.json

package-lock.json

package.json

package.json

tsconfig.json

tsconfig.json

View all files

Repository files navigation

aileaks

Scans a repo, log directory, or CI artifact for LLM provider reasoning-trace blocks —<br>the opaque, ciphertext-looking payloads that Anthropic, OpenAI, and Google return alongside<br>model responses (redacted_thinking.data, reasoning.encrypted_content, thoughtSignature).<br>Teams routinely log these in full for debugging and reproducibility because they look like<br>harmless noise. They aren't: recent research showed these<br>blocks can be decoded back to plaintext, and a scrape of public logs recovered hundreds of PII<br>artifacts and live credentials hiding inside them.

aileaks doesn't perform that decode. It's a detector : it flags any block matching a known<br>provider trace-block shape so you can treat it like a secret — strip it from logs, redact it in<br>CI output, keep it out of public repos — before you find out the hard way.

Install / run

npx aileaks scan .

Or install as a dev dependency:

npm install --save-dev aileaks<br>npx aileaks scan .

CLI

# default: text<br>--ignore # additional glob(s) to skip<br>--no-fail # always exit 0, even with findings">aileaks scan [path] # defaults to the current directory<br>--format text|json> # default: text<br>--ignore glob...> # additional glob(s) to skip<br>--no-fail # always exit 0, even with findings

Exit code is 1 if any findings are present (matching the convention of gitleaks/trufflehog),<br>0 otherwise — so it drops straight into a CI pipeline as a gate.

GitHub Action

- uses: sarthakuwar/aileaks@v0<br>with:<br>path: .<br>fail-on-findings: "true"

What it detects (v1)

Provider<br>Block shape<br>Severity<br>Why

Anthropic<br>type: "redacted_thinking", field data<br>high<br>No accompanying plaintext — the opaque field is the content.

Anthropic<br>type: "thinking", field signature<br>low<br>Reasoning text is already visible; the signature is an integrity tag, still provider ciphertext.

OpenAI<br>type: "reasoning", field encrypted_content<br>high<br>No accompanying plaintext.

Google<br>field thoughtSignature<br>high<br>Opaque reasoning state carried across turns/tool calls.

Every finding also reports a confidence : structural when the file parsed as valid JSON/JSONL<br>and the match is a real object with the exact shape, text when it's a regex match against<br>non-JSON content (timestamped log lines, snippets pasted into a GitHub issue, truncated logs).<br>Structural and text scanners are deduped so a block already caught structurally isn't reported twice.

What it does not do

It does not call any provider API, and it does not attempt the decode/jailbreak technique from<br>the disclosure — see CONTEXT.md for the detect-only rationale.

It does not scan for generic secrets (API keys, passwords) — pair it with<br>gitleaks or trufflehog<br>for that; aileaks covers a category those tools don't know about yet.

Programmatic use

import { scanPath } from "aileaks";

const findings = await scanPath("./logs");

Development

npm install<br>npm run build<br>npm test

About<br>Scan repos/logs for LLM provider reasoning-trace leaks (Anthropic/OpenAI/Google encrypted CoT blocks)<br>Resources<br>Readme<br>MIT license<br>Activity<br>Stars<br>0 stars<br>Watchers<br>0 watching<br>Forks<br>0 forks<br>Report repository

Releases

Packages

Contributors

Languages

You can’t perform that action at this time.