RavenWard

Stops API keys, tokens, private keys and passwords before they reach git — or an AI assistant's settings file. Local only: nothing is sent anywhere.

What it does

Finds

Keys, tokens, private keys, passwords in code and .env — and risky “always allow” permissions that saved a key into a file.

Blocks

A hook before commit and before push. A push to a public repo (checked with gh) is blocked when something is found.

Fixes

ravenward fix moves the value to .env.local and leaves only the variable name in the code.

Reports

A report with file and line — never the value itself.

Install

./install.sh
ravenward install      # git hooks
ravenward scan
ravenward fix
ravenward report

Menu-bar icon

A coloured dot next to the shield: clean found risky settings not checked yet. Menu: last check, what was found, check now, quit.

Private by design

No network calls, no telemetry, no account. Values are kept only in memory while fixing and are never written to reports, logs or state. The core is MIT-licensed.