Introduction
What security-harness-kit (shk) is, the problems it solves for AI-assisted development, and how the pieces fit together.
shk is a command-line tool that finds secrets and PII in a project and stops them from reaching AI coding tools, Git commits, and generated files. It runs on your machine and never sends file contents anywhere. It can also encrypt .env files and inject the decrypted values only into the command you run.
shk scan .Example output:
3 findings
HIGH secret.openai_api_key src/app.ts:12 Possible OpenAI API key detected
MED pii.ja.phone config/dev.ts:5 Japanese phone number pattern detected
MED pii.en.ssn docs/test.md:8 US SSN pattern detected
Failed: findings at or above high (max high).Why
AI coding agents read project files, run shell commands, and write new files from whatever they were given. shk sits in front of those steps: it scans what the agent is about to read or send, masks what you paste into a prompt, and refuses commands such as cat .env before they run.
Scans, masking, and hook checks never make a network request, and audit logs store metadata only. Detection is pattern-based, so treat shk as the check at the AI-tool boundary rather than as your only secret scanner.
What you can do with shk
| Goal | Tools | Read next |
|---|---|---|
| Find leaks | Scan / Git history / MCP audit / Doctor | Quick Start |
| Prepare content for sharing | Mask / Pseudonymize / Clipboard | Desktop |
| Store and use secrets | Env encryption / Runtime injection / AWS・GCP push | Configuration |
| Protect daily work | Git hooks / AI hooks / Action guard / Agent skills | Quick Start |
| Review with your team | CI / Metadata-only audit / Desktop | CI |
How the pieces fit together
- Input / actionFiles, prompts, commands
- shk checksPolicy, detection, action guard
- Handle the resultReport, mask, or block via hooks
| Layer | What it protects | Entry point |
|---|---|---|
| Policy | A single shk.toml defines rules, thresholds, masking, and action guard behavior per project. |
shk init, Configuration |
| Scan | Finds secrets and PII in files, staged changes, or Git history. | shk scan |
| Mask | Redacts or pseudonymizes findings in text and documents so they can be shared safely. | shk mask, shk clipboard, shk pseudonymize |
| Hooks | Blocks or audits risky content and actions inside Git and AI coding tools. | shk hooks install, shk hooks install-ai |
| Env | Encrypts dotenv files, injects values only at runtime, and pushes them to cloud secret managers. | shk env, shk secrets push |
| CI | Runs the same scan on every pull request with a pinned, verified release. | shk ci init github |
| Desktop | A GUI for scanning, masking (redact or pseudonymize), setup automation, and audit review. | Desktop App |
Where to go next
- Installation — install the CLI, and optionally the desktop app on top of it. The hooks the desktop app sets up run the
shkcommand, so the CLI is required for real-time protection. - Quick Start — create a policy, run a scan, and install hooks in a few minutes.
- Commands — the full CLI reference.
- Detection Model — how findings are classified and what is covered.