Scans a repo, log directory, or CI artifact for LLM provider reasoning-trace blocks —
the opaque, ciphertext-looking payloads that Anthropic, OpenAI, and Google return alongside
model responses (redacted_thinking.data
, reasoning.encrypted_content
, thoughtSignature
). Teams routinely log these in full for debugging and reproducibility because they look like harmless noise. They aren't: recent research showed these blocks can be decoded back to plaintext, and a scrape of public logs recovered hundreds of PII artifacts and live credentials hiding inside them.
aileaks
doesn't perform that decode. It's a detector: it flags any block matching a known provider trace-block shape so you can treat it like a secret — strip it from logs, redact it in CI output, keep it out of public repos — before you find out the hard way.
npx aileaks scan .
Or install as a dev dependency:
npm install --save-dev aileaks
npx aileaks scan .
aileaks scan [path] # defaults to the current directory
--format <text|json> # default: text
--ignore <glob...> # additional glob(s) to skip
--no-fail # always exit 0, even with findings
Exit code is 1
if any findings are present (matching the convention of gitleaks/trufflehog),
0
otherwise — so it drops straight into a CI pipeline as a gate.
- uses: sarthakuwar/aileaks@v0
with:
path: .
fail-on-findings: "true"
| Provider | Block shape | Severity | Why |
|---|---|---|---|
| Anthropic | type: "redacted_thinking" , field data |
||
| high | No accompanying plaintext — the opaque field is the content. | ||
| Anthropic | type: "thinking" , field signature |
||
| low | Reasoning text is already visible; the signature is an integrity tag, still provider ciphertext. | ||
| OpenAI | type: "reasoning" , field encrypted_content |
||
| high | No accompanying plaintext. | ||
field thoughtSignature |
|||
| high | Opaque reasoning state carried across turns/tool calls. |
Every finding also reports a confidence: structural
when the file parsed as valid JSON/JSONL
and the match is a real object with the exact shape, text
when it's a regex match against non-JSON content (timestamped log lines, snippets pasted into a GitHub issue, truncated logs). Structural and text scanners are deduped so a block already caught structurally isn't reported twice.
- It does not call any provider API, and it does not attempt the decode/jailbreak technique from
the disclosure — see
CONTEXT.mdfor the detect-only rationale. - It does not scan for generic secrets (API keys, passwords) — pair it with
gitleaksortrufflehogfor that;
aileaks
covers a category those tools don't know about yet.
import { scanPath } from "aileaks";
const findings = await scanPath("./logs");
npm install
npm run build
npm test