For developers using AI coding agents
Stop your AI agent from leaking your API keys and secrets.
To “help,” coding agents read your .env, your keys, and your environment. A single prompt injection or a misbehaving tool call can send them to an attacker. SigmaShake rules can gate the two paths a secret takes to leak out.
Both paths can be gated
- Reading the secret. When an agent tries to read
.env, credentials, SSH keys, or dump the environment, SSG can return DENY, ASK, or FORCE a safer path before the read happens. - Sending it out. The optional Egress Guard plugin can gate outbound requests when it is enabled in enforce mode, so a secret is not quietly sent to an unlisted host. By default, ssg does not block unlisted network domains.
Deterministic and local, the same across Claude Code, Cursor, and Codex, with decisions recorded to a local audit log on a best-effort basis. ssg is a guardrail, not a sandbox: a call that no rule matches is allowed.
30 seconds to protected
1. Install
curl -fsSL install.sigmashake.com | sh -s -- -y2. Wire it in
ssg initRunning -y accepts the Terms of Service. Turn on the credential rules and Egress Guard during setup; see the docs for the exact rule pack.