Developers inadvertently paste .env secrets, infrastructure keys, and customer PII into AI coding assistants like Cursor, Claude Code, and Copilot every day. ReclaimLLM observes developer sessions across tools, redacts credentials locally before they leave developer machines, and automatically flags sensitive sessions for compliance.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
cat .env.production↳ [DLP REDACTED] AWS_SECRET_ACCESS_KEY → [REDACTED:API_KEY]
↳ [DLP REDACTED] DATABASE_URL → postgres://***:***@db.internal:5432
↳ [PII DETECTED] 1 email address & 2 customer IDs flagged for compliance review
↳ Master provider keys isolated · Team-scoped token used · Model policy enforced
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
The Enterprise Threat Model
Every debugging session, command stdout dump, and architecture prompt sent to Claude Code, Cursor, Gemini CLI, or external APIs travels beyond your corporate perimeter. When developers debug with live configurations, proprietary business logic, infrastructure keys, and customer data get permanently logged on non-open-source servers.
Developers run `env`, inspect `.env` files, or dump config maps directly in AI sessions. Plaintext API keys, JWTs, and database URLs flow directly to external model servers.
Pasting production log snippets or debugging customer bugs embeds names, emails, IPs, and user identifiers into model prompts with zero redaction.
Engineering teams build core proprietary workflows across disconnected assistants. Security teams have no audit trail of what code was shared, what tools executed, or what data was exposed.
Architecture & Defense
ReclaimLLM gives security and engineering teams complete session observability, native hook-level secret redaction, and strict data governance without disrupting developer velocity.
Pre-execution secret masking
Native hooks inspect tool inputs and environment files (`.env`, `*.env`, `.envrc`) before execution across Cursor, Claude Code, and Gemini CLI. Passwords, JWTs, and high-entropy credentials are replaced with `[REDACTED:API_KEY]` before model context or session capture can receive them.
Automated risk categorization
All ingested sessions are evaluated for sensitive data exposure. When cloud infrastructure tokens, customer PII, or internal database configs are detected, the session is tagged as sensitive, excluded from public feeds, and highlighted for CISO review.
Credential vault & private VPC
Store provider credentials once in the central LLM Gateway. Developers receive team-scoped tokens so master keys never touch laptops. Raw session blobs are encrypted with AES-256 using customer-held keys, or deployed fully inside your private VPC.
Unified Security Console
Total Monitored Sessions
18,420
Across 4 CLI/IDE tools
Sensitive Sessions Flagged
64
Excluded from public feed
Secrets Masked by DLP
412
Pre-execution at hook
Master Keys on Laptops
0
100% gateway-scoped
| Session / Time | Developer / Tool | Detection & Reason | Security Status |
|---|---|---|---|
| ses_8f291c12 mins ago | [email protected]Claude Code CLI | AWS_SECRET_ACCESS_KEY redacted from .env.productionHook DLP replaced literal secret before model context | AUTO-REDACTED |
| ses_71a0e443 mins ago | [email protected]Cursor | Customer PII detected in prompt debug trace (3 emails)Session tagged as sensitive · Policy compliance alert sent | FLAGGED: SENSITIVE |
| ses_62c9bb2h ago | [email protected]Gemini CLI | JWT signing secret masked in config file readToken replaced with [REDACTED:JWT] | AUTO-REDACTED |
| ses_50e3fa3h ago | [email protected]Antigravity | Routine Postgres query optimization sessionNo credentials or sensitive data detected | VERIFIED CLEAN |
| ses_44b2014h ago | [email protected]GitHub Copilot (Gateway) | Corporate LLM Gateway session trace audited via OTELTeam key used · Model policy verified · Zero leaked credentials | AUDITED GATEWAY |
Full-Lifecycle Governance
Zero-code native hooks for Gemini CLI, Antigravity, Claude Code, Cursor, Codex, and LiteLLM proxies with pre-execution endpoint DLP secret masking.
◈Full session timelines capture paired tool executions, terminal stdout/stderr, and structured git file diffs for PR reviews and incident audits.
⊞Centralized credential vault for OpenAI, Anthropic, Gemini, and Azure OpenAI with team-scoped gateway keys and model policy rules.
⊟PostgreSQL materialized views refreshed every 15 minutes break down token spend and consumption by team, developer, repo, and model.
⌁Range-aware read caching and test output compaction strip redundant prompt tokens locally, cutting tool-result tokens by up to 40% on benchmark workloads (16.5% overall average).
⬡AES-256 raw transcript encryption with customer recovery keys, US/EU cloud regions, and Docker/Helm private VPC self-hosting options.
Enterprise Trust Guarantee
ReclaimLLM is built from the ground up for organizations with strict security, privacy, and compliance requirements. Every session captured is strictly tenant-isolated, encrypted at rest, and can be hosted entirely within your cloud perimeter.
Two Commands to Security
Install the CLI and configure native hooks. In seconds, developer coding tools are secured with default-on DLP secret masking and sensitive session detection.
$ pip install rclm
$ rclm-hooks-install
✓ Hooks installed for Claude Code, Cursor, Gemini CLI, Antigravity
✓ Default-on DLP active: .env and credential patterns protected
→ Live security audit at reclaimllm.com/dashboard
AI Data Security & Privacy
Eliminate secret leaks, flag unvetted PII in prompt streams, and retain a tamper-evident compliance audit trail across every developer coding session.