Building client-side privacy tools in high school: Seeking architecture feedback!

Hi everyone! I'm Winn Htut Hein, a high school student from Myanmar learning to build and ship software.

I recently launched an offline privacy tool called ZeroLeak. It runs 100% client-side in the browser to strip API keys, tokens, and secrets from code snippets before you paste them into AI chats like Claude or ChatGPT.

Since I am focused on learning how to design proper architectures, I would love some honest code feedback from the community.

Is a pure client-side regex parsing tree secure enough for this? How can I improve my project setup?

You can check out the source code here: https://github.com/winnhtuthein/zeroleak

Any advice or criticism is highly appreciated!