# Show HN: Aileaks – scan repos for leaked LLM reasoning-trace secrets

> Source: <https://github.com/sarthakuwar/aileaks>
> Published: 2026-08-12 12:57:02+00:00

Scans a repo, log directory, or CI artifact for LLM provider **reasoning-trace blocks** —
the opaque, ciphertext-looking payloads that Anthropic, OpenAI, and Google return alongside
model responses (`redacted_thinking.data`

, `reasoning.encrypted_content`

, `thoughtSignature`

).
Teams routinely log these in full for debugging and reproducibility because they look like
harmless noise. They aren't: [recent research](https://arxiv.org/abs/2608.09867) showed these
blocks can be decoded back to plaintext, and a scrape of public logs recovered hundreds of PII
artifacts and live credentials hiding inside them.

`aileaks`

doesn't perform that decode. It's a **detector**: it flags any block matching a known
provider trace-block shape so you can treat it like a secret — strip it from logs, redact it in
CI output, keep it out of public repos — before you find out the hard way.

```
npx aileaks scan .
```

Or install as a dev dependency:

```
npm install --save-dev aileaks
npx aileaks scan .
aileaks scan [path]              # defaults to the current directory
  --format <text|json>           # default: text
  --ignore <glob...>             # additional glob(s) to skip
  --no-fail                      # always exit 0, even with findings
```

Exit code is `1`

if any findings are present (matching the convention of gitleaks/trufflehog),
`0`

otherwise — so it drops straight into a CI pipeline as a gate.

```
- uses: sarthakuwar/aileaks@v0
  with:
    path: .
    fail-on-findings: "true"
```

| Provider | Block shape | Severity | Why |
|---|---|---|---|
| Anthropic | `type: "redacted_thinking"` , field `data` |
high | No accompanying plaintext — the opaque field is the content. |
| Anthropic | `type: "thinking"` , field `signature` |
low | Reasoning text is already visible; the signature is an integrity tag, still provider ciphertext. |
| OpenAI | `type: "reasoning"` , field `encrypted_content` |
high | No accompanying plaintext. |
field `thoughtSignature` |
high | Opaque reasoning state carried across turns/tool calls. |

Every finding also reports a **confidence**: `structural`

when the file parsed as valid JSON/JSONL
and the match is a real object with the exact shape, `text`

when it's a regex match against
non-JSON content (timestamped log lines, snippets pasted into a GitHub issue, truncated logs).
Structural and text scanners are deduped so a block already caught structurally isn't reported twice.

- It does not call any provider API, and it does not attempt the decode/jailbreak technique from
the disclosure — see
[CONTEXT.md](/sarthakuwar/aileaks/blob/master/CONTEXT.md)for the detect-only rationale. - It does not scan for generic secrets (API keys, passwords) — pair it with
[gitleaks](https://github.com/gitleaks/gitleaks)or[trufflehog](https://github.com/trufflesecurity/trufflehog)for that;`aileaks`

covers a category those tools don't know about yet.

``` js
import { scanPath } from "aileaks";

const findings = await scanPath("./logs");
npm install
npm run build
npm test
```