Security model

Cloakroom’s job is to keep secrets and personal data away from the model, so a way around it is a security bug.

What is stored

The vault: Values go into the vault, an encrypted file kept per session (AES-GCM, key in the OS secure store).
The file log: The log (~/.cloakroom/filelog.bin) is encrypted like the vault and holds no values: they are read back from the file when needed.
Your rules: These rules are stored encrypted in ~/.cloakroom/rules.bin; the allow list stays yours to edit by hand.
The activity log: Tamper-evident, not tamper-proof. The activity log keeps no values or text, but it does keep file paths (masked like any output) and the program name of shell commands.
Held commands: Only a keyed hash of the held command is stored (~/.cloakroom/held.json).
Keys you hand over: Entries from cloakroom give expire after 24 hours; --forget removes one now.

Where

The vault key

Vault files are AES-GCM encrypted; the key lives in the OS secure store (macOS Keychain, Windows Credential Manager, Linux Secret Service), or CLOAKROOM_VAULT_KEY, or a 0600 key file when no store exists (doctor warns).

Cloakroom’s own folder

Claude’s own tool calls can’t change ~/.cloakroom (writes there, or shell commands naming it, are denied), so it can’t pause Cloakroom or edit its rules.

The dashboard

The dashboard (cloakroom dashboard) is reachable only on 127.0.0.1, with a one-time sign-in link; restarting the service signs the browser out.

Claude Code’s own records

Claude Code’s local session log (~/.claude/projects/...) records the hook’s rewritten tool input, so values put back into a file also appear in that log on your disk. They are not sent to the model.

What leaves your machine

The model, once: First run downloads the detection model (PII-Tracer, pinned revision) from Hugging Face; offline machines need it cached first.
Sending data: Commands that would send a secret off your machine, or move money, wait for your OK. A web fetch, an MCP tool call or a prompt to a subagent that holds a real value is stopped before it runs.
Not covered: Codex’s own web search (runs on OpenAI’s servers).

What it cannot catch

It stops accidental exposure: secrets and personal data in files, logs and command output an agent reads while working. It is not a sandbox (a sealed-off space the AI can’t get out of). Out of scope: an AI, or hidden instructions in a file that steer it (a prompt injection), determined to sneak data out through custom encodings or values built piece by piece; data you paste into prompts on purpose (prompts can be blocked, not rewritten); what other tools on your machine send elsewhere.

Prompts

Prompts can only be blocked, not masked. A blocked prompt never reaches the model, but Claude Code keeps it in its local session records on disk.

Failed commands

In Claude Code, the error output of a tool call that fails goes through a hook event that lets a hook add notes but not change the text. So it can’t be masked and may reach the model with a key or personal value in it. Keep keys out of commands that print them.

Secrets it has never seen

Disguised copies are computed from values Cloakroom already knows, so a secret it has never seen isn’t caught in any form. Not covered: salted or keyed hashes (HMAC, bcrypt, scrypt), other hashes (SHA-512, CRC), base32, upper/lower case changes of a key, and values shorter than 8 characters.

Keys written by scripts

A key split into pieces, or one with no known pattern and not seen earlier in the session, isn’t caught when a file is written.

Money moved by programs

The money-movement hold sees the command or tool call, not what a program does once it runs. A script or app that calls a payment API isn’t held.

The exposure list

cloakroom exposure lists only what Cloakroom detected: a key it missed leaves no line, so an empty list is not proof nothing leaked.

Every limit found in live tests, per agent: Known limits.

Report a way around it

Privately: Please report privately through GitHub: the Security tab of the repo, then Report a vulnerability. Don’t open a public issue for a bypass; it would teach everyone the trick before there’s a fix.
What to include: The Cloakroom version (uv tool list or pip show cloakroom), your OS, the mode (full or rules), and a minimal example with fake values that shows the problem.
Response: This is a one-person project. I aim to reply within a week and to ship a fix, with credit if you want it, before the details are public.