aileaks

Scans a repo, log directory, or CI artifact for LLM provider reasoning-trace blocks — the opaque, ciphertext-looking payloads that Anthropic, OpenAI, and Google return alongside model responses (redacted_thinking.data, reasoning.encrypted_content, thoughtSignature). Teams routinely log these in full for debugging and reproducibility because they look like harmless noise. They aren't: recent research showed these blocks can be decoded back to plaintext, and a scrape of public logs recovered hundreds of PII artifacts and live credentials hiding inside them.

aileaks doesn't perform that decode. It's a detector: it flags any block matching a known provider trace-block shape so you can treat it like a secret — strip it from logs, redact it in CI output, keep it out of public repos — before you find out the hard way.

Install / run

npx aileaks scan .

Or install as a dev dependency:

npm install --save-dev aileaks
npx aileaks scan .

CLI

aileaks scan [path]              # defaults to the current directory
  --format <text|json>           # default: text
  --ignore <glob...>             # additional glob(s) to skip
  --no-fail                      # always exit 0, even with findings

Use - as the path to read from stdin instead of walking a directory — for content that never touches the filesystem, e.g. a transcript column pulled straight out of a database:

psql -Atc "select transcript from agent_runs where id = 42" | aileaks scan -

Exit code is 1 if any findings are present (matching the convention of gitleaks/trufflehog), 0 otherwise — so it drops straight into a CI pipeline as a gate.

GitHub Action

- uses: sarthakuwar/aileaks@v0
  with:
    path: .
    fail-on-findings: "true"

What it detects (v1)

| Provider | Block shape | Severity | Why | |---|---|---|---| | Anthropic | type: "redacted_thinking", field data | high | No accompanying plaintext — the opaque field is the content. | | Anthropic | type: "thinking", field signature | low | Reasoning text is already visible; the signature is an integrity tag, still provider ciphertext. | | OpenAI | type: "reasoning", field encrypted_content | high | No accompanying plaintext. | | Google | field thoughtSignature | high | Opaque reasoning state carried across turns/tool calls. |

Every finding also reports a confidence: structural when the file parsed as valid JSON/JSONL and the match is a real object with the exact shape, text when it's a regex match against non-JSON content (timestamped log lines, snippets pasted into a GitHub issue, truncated logs). Structural and text scanners are deduped so a block already caught structurally isn't reported twice.

What it does not do

• It does not call any provider API, and it does not attempt the decode/jailbreak technique from the disclosure — see CONTEXT.md for the detect-only rationale.
• It does not scan for generic secrets (API keys, passwords) — pair it with gitleaks or trufflehog for that; aileaks covers a category those tools don't know about yet.

Programmatic use

import { scanPath } from "aileaks";

const findings = await scanPath("./logs");

Development

npm install
npm run build
npm test