The same failures we find in audits, turned into tooling you can install today. MIT licensed, no account, no telemetry. They run on the wire and in CI, so a leak fails the build instead of reaching production.
An assistant wires an integration the quick way and a secret ends up in the frontend, a prompt carries a customer record to a third party, or an agent loops overnight into a large bill. None of it shows up in code review, because the problem is in the data and the runtime, not the diff. These packages watch the places review cannot.
Finds AI provider keys leaked into tracked or browser-reachable files, and flags model output flowing into unsafe sinks. Dev-only, gates CI.
Scans, redacts, and can block outbound requests to OpenAI, Anthropic, and Gemini when a prompt carries secrets or PII. Works at the HTTP layer, no proxy.
Stops runaway agents: breaks loops inside one request and opens a circuit on a per-tenant spend anomaly. Observes by default, blocks when you are ready.
Turns AI traffic into a GDPR Article 30 record of processing and a subprocessor register. Categories and hashes only, never the data itself.
Scans outgoing Laravel mail for leaked secrets, PII, and compliance issues. Preview in an inbox, block unsafe sends, and fail CI before email leaks.
These catch the leaks a scanner can see: exposed keys, secrets and PII on the wire, runaway spend, missing records. They are the cheap first gate on every commit. The logic flaws that actually sink an app, broken authorization, mass assignment, an insecure flow across three files, need a human who has seen the exploits. That is the audit.
The free packages handle the obvious leaks. Book an audit for the logic flaws underneath.