{"slug": "show-hn-hamza-mask-secrets-and-pii-before-claude-code-or-codex-sends-them", "title": "Show HN: Hamza Mask secrets and PII before Claude Code or Codex sends them", "summary": "Hamza, a proxy for Claude Code and Codex, masks secrets and personal data before prompts reach Anthropic or OpenAI, reducing exposure of credentials and customer records that coding agents may inadvertently include in requests. The tool uses a secret scanner, Presidio, and registered-value detection to replace detected values with placeholders like <SECRET_1> or <EMAIL_1>, while writing audit records without prompt text.", "body_md": "*The name Hamza is inspired by the undercover operative in\n*\n\n*Dhurandhar*.\n\nHamza is a proxy for Claude Code and Codex. It masks detected secrets and approved types of personal data before sending prompts to Anthropic or OpenAI.\n\n## hamza-claude-code-demo.mp4\n\nAn agent debugging an import job may read a CSV, an `.env`\n\nfile, and application\nlogs. That context can contain customer data and credentials. Hamza masks\ndetected values while leaving the rest of the prompt intact:\n\n```\nBefore: patient=priya.fixture@example.com  key=AKIAABCDEFGHIJKLMNOP\nAfter:  patient=<EMAIL_482191>             key=<SECRET_730044>\n```\n\nThe same value gets the same placeholder within a request. This lets the model follow references without receiving the original value.\n\nExisting security tools may not see the final request assembled by a coding agent.\n\n| Control | What it sees | What it can miss |\n|---|---|---|\n| Git secret scanning | Committed files | A key read from `.env` but never committed |\n| Endpoint DLP | Files, email, and removable storage | Data inside an allowed HTTPS request |\n| Web security tools | Browser traffic | A CLI process calling an approved API |\n| Code review | Source-code changes | Logs and files added to a prompt |\n\nA developer may ask an agent to debug an import job without knowing which files the agent will read. Customer records or credentials can then leave the network inside a normal request to an approved AI service.\n\nThis creates work for security and compliance teams. They may need to rotate a credential, investigate which records left the network, or change the contract with the AI vendor. Hamza reduces that exposure by masking detected values before the request leaves.\n\nHamza does not replace access controls, retention rules, or legal agreements.\n\n``` php\nflowchart LR\n    A[\"Claude Code or Codex\"] --> B[\"Hamza proxy\"]\n    B --> C[\"Find secrets and personal data\"]\n    C --> D[\"Apply the configured action\"]\n    D -->|\"mask\"| E[\"Replace the detected value\"]\n    D -->|\"allow\"| F[\"Anthropic or OpenAI\"]\n    D -->|\"block\"| G[\"Stop the request\"]\n    E --> F\n```\n\n- Hamza inspects supported request bodies from Claude Code or Codex.\n- It finds the text sent to the AI service.\n- The secret scanner, registered-value detector, and Presidio inspect that text.\n- Depending on the rule, Hamza records, masks, or blocks the finding.\n- For masking rules, it replaces the detected value with a placeholder such as\n`<SECRET_1>`\n\nor`<EMAIL_1>`\n\n.\n\nHamza also writes an audit record with the action, detector, and byte counts. The record contains no prompt text or matched values.\n\n| Detector | Finds |\n|---|---|\n| Secret scanner | Cloud, source-control, package-registry, and SaaS credentials |\n| Presidio | Email, phone, payment-card, IP, and other approved data types |\n\nYou can also register customer values that Hamza should recognize.\n\nThe full Presidio entity list and thresholds are in\n[ detector/presidio/approved-profile.json](/softcane/hamza/blob/main/detector/presidio/approved-profile.json).\n\nYou need Docker Compose.\n\n```\nHAMZA_POSTURE=MASK docker compose up -d --build\n```\n\nThe first start may take a minute while Presidio loads.\n\nSet the Anthropic base URL:\n\n```\nexport ANTHROPIC_BASE_URL=http://127.0.0.1:10000\nclaude\n```\n\nAdd the export to your shell profile if you want to keep it across sessions.\nClaude Code also accepts `ANTHROPIC_BASE_URL`\n\nin the `env`\n\nsection of\n`settings.json`\n\n.\n\nAdd this to `~/.codex/config.toml`\n\n:\n\n```\n[model_providers.hamza]\nname = \"hamza\"\nbase_url = \"http://127.0.0.1:10000/backend-api/codex\"\nwire_api = \"responses\"\nrequires_openai_auth = true\n\n[profiles.hamza]\nmodel_provider = \"hamza\"\n```\n\nThen start Codex with the profile:\n\n```\ncodex --profile hamza\n```\n\n| Address | Service |\n|---|---|\n`http://127.0.0.1:10000` |\nProxy used by Claude Code and Codex |\n`http://127.0.0.1:3000` |\nGrafana dashboard |\n`http://127.0.0.1:8080/actuator/prometheus` |\nPrometheus metrics |\n\nPresidio runs inside the Docker network and has no host port.\n\nTo disable Presidio:\n\n```\nHAMZA_PRESIDIO_ENABLED=false \\\n  HAMZA_POSTURE=MASK \\\n  docker compose up -d --build --scale presidio=0\n```\n\nHamza requires Java 25 and Maven 3.9.11.\n\n```\nmvn -B clean verify\ndocker build .\n```\n\nSee [ CONTEXT.md](/softcane/hamza/blob/main/CONTEXT.md) for the domain model and\n\n[for the complete test suite.](/softcane/hamza/blob/main/AGENTS.md)\n\n`AGENTS.md`", "url": "https://wpnews.pro/news/show-hn-hamza-mask-secrets-and-pii-before-claude-code-or-codex-sends-them", "canonical_source": "https://github.com/softcane/hamza", "published_at": "2026-07-28 21:35:54+00:00", "updated_at": "2026-07-28 21:53:14.902190+00:00", "lang": "en", "topics": ["ai-tools", "ai-safety", "ai-infrastructure"], "entities": ["Hamza", "Claude Code", "Codex", "Anthropic", "OpenAI", "Presidio", "Docker Compose", "Grafana"], "alternates": {"html": "https://wpnews.pro/news/show-hn-hamza-mask-secrets-and-pii-before-claude-code-or-codex-sends-them", "markdown": "https://wpnews.pro/news/show-hn-hamza-mask-secrets-and-pii-before-claude-code-or-codex-sends-them.md", "text": "https://wpnews.pro/news/show-hn-hamza-mask-secrets-and-pii-before-claude-code-or-codex-sends-them.txt", "jsonld": "https://wpnews.pro/news/show-hn-hamza-mask-secrets-and-pii-before-claude-code-or-codex-sends-them.jsonld"}}