Show HN: Aileaks – scan repos for leaked LLM reasoning-trace secrets

A new open-source tool, aileaks, scans repositories, log directories, and CI artifacts for LLM provider reasoning-trace blocks—opaque payloads from Anthropic, OpenAI, and Google that can be decoded to reveal plaintext, including PII and live credentials. The detector, released on GitHub by sarthakuwar, flags blocks matching known shapes (e.g., redacted_thinking.data, reasoning.encrypted_content, thoughtSignature) and integrates into CI pipelines with exit code 1 on findings, complementing secret scanners like gitleaks and trufflehog.

Scans a repo, log directory, or CI artifact for LLM provider reasoning-trace blocks — the opaque, ciphertext-looking payloads that Anthropic, OpenAI, and Google return alongside model responses redacted thinking.data , reasoning.encrypted content , thoughtSignature . Teams routinely log these in full for debugging and reproducibility because they look like harmless noise. They aren't: recent research https://arxiv.org/abs/2608.09867 showed these blocks can be decoded back to plaintext, and a scrape of public logs recovered hundreds of PII artifacts and live credentials hiding inside them. aileaks doesn't perform that decode. It's a detector : it flags any block matching a known provider trace-block shape so you can treat it like a secret — strip it from logs, redact it in CI output, keep it out of public repos — before you find out the hard way. npx aileaks scan . Or install as a dev dependency: npm install --save-dev aileaks npx aileaks scan . aileaks scan path defaults to the current directory --format <text|json default: text --ignore <glob... additional glob s to skip --no-fail always exit 0, even with findings Exit code is 1 if any findings are present matching the convention of gitleaks/trufflehog , 0 otherwise — so it drops straight into a CI pipeline as a gate. - uses: sarthakuwar/aileaks@v0 with: path: . fail-on-findings: "true" | Provider | Block shape | Severity | Why | |---|---|---|---| | Anthropic | type: "redacted thinking" , field data | high | No accompanying plaintext — the opaque field is the content. | | Anthropic | type: "thinking" , field signature | low | Reasoning text is already visible; the signature is an integrity tag, still provider ciphertext. | | OpenAI | type: "reasoning" , field encrypted content | high | No accompanying plaintext. | field thoughtSignature | high | Opaque reasoning state carried across turns/tool calls. | Every finding also reports a confidence : structural when the file parsed as valid JSON/JSONL and the match is a real object with the exact shape, text when it's a regex match against non-JSON content timestamped log lines, snippets pasted into a GitHub issue, truncated logs . Structural and text scanners are deduped so a block already caught structurally isn't reported twice. - It does not call any provider API, and it does not attempt the decode/jailbreak technique from the disclosure — see CONTEXT.md /sarthakuwar/aileaks/blob/master/CONTEXT.md for the detect-only rationale. - It does not scan for generic secrets API keys, passwords — pair it with gitleaks https://github.com/gitleaks/gitleaks or trufflehog https://github.com/trufflesecurity/trufflehog for that; aileaks covers a category those tools don't know about yet. js import { scanPath } from "aileaks"; const findings = await scanPath "./logs" ; npm install npm run build npm test