{"slug": "show-hn-aileaks-scan-repos-for-leaked-llm-reasoning-trace-secrets", "title": "Show HN: Aileaks – scan repos for leaked LLM reasoning-trace secrets", "summary": "A new open-source tool, aileaks, scans repositories, log directories, and CI artifacts for LLM provider reasoning-trace blocks—opaque payloads from Anthropic, OpenAI, and Google that can be decoded to reveal plaintext, including PII and live credentials. The detector, released on GitHub by sarthakuwar, flags blocks matching known shapes (e.g., redacted_thinking.data, reasoning.encrypted_content, thoughtSignature) and integrates into CI pipelines with exit code 1 on findings, complementing secret scanners like gitleaks and trufflehog.", "body_md": "Scans a repo, log directory, or CI artifact for LLM provider **reasoning-trace blocks** —\nthe opaque, ciphertext-looking payloads that Anthropic, OpenAI, and Google return alongside\nmodel responses (`redacted_thinking.data`\n\n, `reasoning.encrypted_content`\n\n, `thoughtSignature`\n\n).\nTeams routinely log these in full for debugging and reproducibility because they look like\nharmless noise. They aren't: [recent research](https://arxiv.org/abs/2608.09867) showed these\nblocks can be decoded back to plaintext, and a scrape of public logs recovered hundreds of PII\nartifacts and live credentials hiding inside them.\n\n`aileaks`\n\ndoesn't perform that decode. It's a **detector**: it flags any block matching a known\nprovider trace-block shape so you can treat it like a secret — strip it from logs, redact it in\nCI output, keep it out of public repos — before you find out the hard way.\n\n```\nnpx aileaks scan .\n```\n\nOr install as a dev dependency:\n\n```\nnpm install --save-dev aileaks\nnpx aileaks scan .\naileaks scan [path]              # defaults to the current directory\n  --format <text|json>           # default: text\n  --ignore <glob...>             # additional glob(s) to skip\n  --no-fail                      # always exit 0, even with findings\n```\n\nExit code is `1`\n\nif any findings are present (matching the convention of gitleaks/trufflehog),\n`0`\n\notherwise — so it drops straight into a CI pipeline as a gate.\n\n```\n- uses: sarthakuwar/aileaks@v0\n  with:\n    path: .\n    fail-on-findings: \"true\"\n```\n\n| Provider | Block shape | Severity | Why |\n|---|---|---|---|\n| Anthropic | `type: \"redacted_thinking\"` , field `data` |\nhigh | No accompanying plaintext — the opaque field is the content. |\n| Anthropic | `type: \"thinking\"` , field `signature` |\nlow | Reasoning text is already visible; the signature is an integrity tag, still provider ciphertext. |\n| OpenAI | `type: \"reasoning\"` , field `encrypted_content` |\nhigh | No accompanying plaintext. |\nfield `thoughtSignature` |\nhigh | Opaque reasoning state carried across turns/tool calls. |\n\nEvery finding also reports a **confidence**: `structural`\n\nwhen the file parsed as valid JSON/JSONL\nand the match is a real object with the exact shape, `text`\n\nwhen it's a regex match against\nnon-JSON content (timestamped log lines, snippets pasted into a GitHub issue, truncated logs).\nStructural and text scanners are deduped so a block already caught structurally isn't reported twice.\n\n- It does not call any provider API, and it does not attempt the decode/jailbreak technique from\nthe disclosure — see\n[CONTEXT.md](/sarthakuwar/aileaks/blob/master/CONTEXT.md)for the detect-only rationale. - It does not scan for generic secrets (API keys, passwords) — pair it with\n[gitleaks](https://github.com/gitleaks/gitleaks)or[trufflehog](https://github.com/trufflesecurity/trufflehog)for that;`aileaks`\n\ncovers a category those tools don't know about yet.\n\n``` js\nimport { scanPath } from \"aileaks\";\n\nconst findings = await scanPath(\"./logs\");\nnpm install\nnpm run build\nnpm test\n```\n\n", "url": "https://wpnews.pro/news/show-hn-aileaks-scan-repos-for-leaked-llm-reasoning-trace-secrets", "canonical_source": "https://github.com/sarthakuwar/aileaks", "published_at": "2026-08-12 12:57:02+00:00", "updated_at": "2026-08-12 13:13:36.026277+00:00", "lang": "en", "topics": ["ai-tools", "ai-safety", "developer-tools"], "entities": ["aileaks", "Anthropic", "OpenAI", "Google", "sarthakuwar", "gitleaks", "trufflehog"], "alternates": {"html": "https://wpnews.pro/news/show-hn-aileaks-scan-repos-for-leaked-llm-reasoning-trace-secrets", "markdown": "https://wpnews.pro/news/show-hn-aileaks-scan-repos-for-leaked-llm-reasoning-trace-secrets.md", "text": "https://wpnews.pro/news/show-hn-aileaks-scan-repos-for-leaked-llm-reasoning-trace-secrets.txt", "jsonld": "https://wpnews.pro/news/show-hn-aileaks-scan-repos-for-leaked-llm-reasoning-trace-secrets.jsonld"}}