Skip to content
hushbridge.
hushbridge.

Use cases

Ask AI about config and code with the keys swapped for placeholders.

Hushbridge finds common API keys, connection strings and personal data in technical text. It swaps them on your device before you ask for help.

A USB security key beside a laptop and closed notebook

The task

A deploy fails and the error points at your configuration. You want to paste the .env file and a sample request into an AI chat and ask what is wrong.

Those files hold live keys, database passwords and real customer records. The AI needs the variable names and the structure. It does not need the values. With placeholders, it can still say that DATABASE_URL looks wrong or that a field is missing.

Before and after

We ran a fictional .env snippet and a small JSON object through the Hushbridge engine with its developer profile, using one swap table for both. The keys are fake. The right column is the engine’s real output, unedited.

Fictional example

What you start with

# Fictional example. These are not real credentials.
APP_ENV=staging
STRIPE_SECRET_KEY=sk_test_51ExampleExampleExampleExample00
DATABASE_URL=postgres://orders_app:Example-Pass-2024@db.staging.example.com:5432/orders
SUPPORT_EMAIL=ops-team@example.com

{
  "customer": {
    "name": "Nadia Ferreira",
    "email": "nadia.ferreira@example.com",
    "phone": "(206) 555-0163"
  },
  "lastLoginIp": "203.0.113.24",
  "orderTotal": 129.5,
  "retry": true
}

What the AI receives

# Fictional example. These are not real credentials.
APP_ENV=staging
STRIPE_SECRET_KEY=[SECRET_1]
DATABASE_URL=[SECRET_2]
SUPPORT_EMAIL=[EMAIL_1]

{
  "customer": {
    "name": "[PERSON_1]",
    "email": "[EMAIL_2]",
    "phone": "[PHONE_1]"
  },
  "lastLoginIp": "[IP_ADDRESS_1]",
  "orderTotal": 129.5,
  "retry": true
}
Keys and connection strings
2
Email addresses
2
Names
1
Phone numbers
1
IP addresses
1

Restoring the placeholders on the device gave back the original text exactly in this run.

Did the syntax survive?

Yes, for this example. After the swap, every .env line still has the KEY=value shape, and the JSON object still parses. We checked by running JSON.parse on the protected text. The placeholders land inside the existing quotes, so the strings stay strings.

No, for a second test. When a card number is written as a bare JSON number, without quotes, the placeholder goes in without quotes too. JSON.parse then fails on the protected text. Restoring it still gives back the exact original.

Bare number in JSON

{
  "card": 4111111111111111,
  "currency": "USD"
}

After the swap: no longer valid JSON

{
  "card": [CREDIT_CARD_1],
  "currency": "USD"
}

What you review before sending

  1. 1Read every value in the protected text. Keys from providers the engine does not know can stay in plain text.
  2. 2Check custom variables that hold secrets in an unusual format, such as INTERNAL_TOKEN.
  3. 3Look for hostnames, internal URLs and bucket names. A URL is swapped only when it carries a query, credentials or a token-like ID.
  4. 4Check sensitive values written as bare numbers in JSON or code. Their placeholders break the syntax, as the second test shows.
  5. 5Rotate any real key you sent by mistake. Deleting the chat does not undo it.

Limits

  • Detection uses rules, checksums and name lists. It has no language model. A name with no cue, such as a title, a role or a label, can be missed. Add names you know matter to your always-protect list.
  • In this run the .env lines and the JSON object stayed valid after the swap. A sensitive value written as a bare JSON number did not: the protected JSON stopped parsing. Quote such values, or expect the AI to see invalid syntax.
  • Secret detection covers known key formats, JWTs, PEM private keys, bearer tokens, connection strings and password assignments. A secret in an unknown format can be missed.
  • Personal data inside code, such as names in test fixtures, is found by the same rules as in plain text.
  • The browser extension does not scan attachments. Paste the text you want help with into the prompt, and review it there.
  • A chat site's page can read text while you type it, before anything is swapped. For sensitive work, prepare the text in the free check first, then paste the protected version into the chat.
  • Review before sending stays necessary. Hushbridge shows you what the AI will get. You decide whether it is safe to send.

Try it

The free check runs in your browser and sends no text to an AI model. Paste a short config snippet with fake values and see what would be swapped.

Open the free check

Remove sensitive details before your next AI prompt.

Try the free check ↗