Show HN: LocalMask – local-first CLI that masks PII and secrets before LLMs

LocalMask, a new open-source CLI tool, masks personally identifiable information (PII) and secrets in code repositories before sending them to large language models (LLMs). The tool creates private, masked git mirrors that AI tools can safely read, supporting GitHub, GitLab, Bitbucket, and self-hosted git. It addresses security concerns around exposing sensitive data when using AI coding assistants.

with pipx — recommended, works anywhere pipx install localmask or with pip — inside a virtualenv python3 -m venv .venv && .venv/bin/pip install localmask then scan any repo localmask scan ./your-repo It's on PyPI as localmask . On a Mac you can also brew install sgury/localmask/localmask , or grab the tarball /dl?f=free . Then localmask publish <scan <masked-repo-url creates a private masked git mirror your AI tools can safely read. Works with GitHub, GitLab, Bitbucket, self-hosted git & Google Secure Source Manager. Tokens are handled via GIT ASKPASS — never in a URL, process args, or .git/config — and only masked content is ever pushed. In free you use your own AI paste the masked files or point it at the mirror ; Pro adds built-in Ask-AI + the proxy. Full guide & security on GitHub → https://github.com/sgury/localmask readme