DEV Community

Ilya Sib
Ilya Sib

Posted on

How to Stop Leaking API Keys and PII to LLMs: Zero-Trust In-Memory Sanitization for Cursor & Claude

#ai #privacy #opensource #security

If you are using AI coding assistants like Cursor, Windsurf, Claude Desktop, or ChatGPT, you have probably pasted a snippet containing sensitive data at least once:

  • Hardcoded AWS or OpenAI API keys
  • Database connection strings (postgres://user:password@host/db)
  • JWT tokens and private RSA keys
  • Real customer emails, IP addresses, or internal employee IDs

Traditional Data Loss Prevention (DLP) relies on remote cloud proxies that intercept your traffic, inspect it on a third-party server, and add 200ms–500ms of latency to every autocomplete or prompt.

Here is how to solve this using Zero-Trust Data Sanitization (ZTDS)—sanitizing sensitive data 100% locally in volatile RAM before network serialization.

The Problem: Cloud DLP Adds Latency and Creates Honeypots

When you route AI traffic through intermediate cloud DLP proxies:

  1. Network Jitter: Remote webhook inspection halts your prompt loop.
  2. Sub-Processor Liabilities: Routing sensitive customer data to a third-party inspection vendor requires signing complex Data Processing Agreements (DPAs) under GDPR and HIPAA.
  3. Telemetry Honeypots: Prompt data stored in proxy logs becomes a centralized target for credential leaks.

The Architecture: Client-Side Zero-Trust Data Sanitization (ZTDS)

The core principle behind ZTDS is simple: Zero server infrastructure. Everything executes in client memory.

┌─────────────────────────────────────────────────────────────────────────────┐
│                    DEVELOPER WORKSTATION (LOCAL RAM)                        │
│                                                                             │
│  ┌──────────────────────┐  Structured Stream  ┌──────────────────────────┐  │
│  │ IDE / Browser Tab    │ ──────────────────> │ In-Memory DFA Automata   │  │
│  │ (Code / Prompt)      │                     │ (Regex Tokenizer)        │  │
│  └──────────────────────┘ <────────────────── └─────────────┬────────────┘  │
│       ▲                    (Sanitized Stream)               │               │
│       │                                                     ▼               │
│       │                                       ┌──────────────────────────┐  │
│       │                                       │ Volatile sessionMap      │  │
│       │                                       │ (Heap Memory Only)       │  │
│       │                                       └─────────────┬────────────┘  │
│       │                                                     │               │
│       │          Lossless Reverse Rehydration Loop          │               │
│       └─────────────────────────────────────────────────────┘               │
└─────────────────────────────────────────────────────────────────────────────┘
                                   │
                      Sanitized Socket Stream ([TOKEN_N])
                                   ▼
                        ┌───────────────────┐
                        │ External Cloud AI │
                        │ (Zero Raw PII)    │
                        └───────────────────┘
Enter fullscreen mode Exit fullscreen mode

Key Engineering Properties:

  • Deterministic Automata Execution: Pre-compiled DFA patterns execute across 25+ industry profiles (Software Engineering, Finance, Health, Legal). Matches are sorted in descending index order to prevent character offset drift.
  • Sub-2ms Latency: Microbenchmarks across 10,000 synthetic payloads show a mean execution latency of 1.92ms (an ~80x to ~400x speedup compared to remote cloud proxies).
  • RAM-Only Isolation: All token mappings exist strictly in volatile process memory and are destroyed upon process exit or tab reload. Zero disk persistence, zero cookies, zero external telemetry.
  • 1-Click Bijective Reveal: When the LLM responds with surrogate tokens, they are mapped back to their original identities locally.

Setting Up the Open-Source MCP Server in Cursor & Claude Desktop

We open-sourced the official Model Context Protocol (MCP) server: @privacyscrubber/mcp-server.

You can run it instantly without installation via npx:

npx -y @privacyscrubber/mcp-server
Enter fullscreen mode Exit fullscreen mode

1. Claude Desktop Integration

Add the server to your claude_desktop_config.json:

{
  "mcpServers": {
    "privacyscrubber": {
      "command": "npx",
      "args": ["-y", "@privacyscrubber/mcp-server"]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

2. Cursor IDE Integration

In Cursor settings under Features > MCP, click Add New MCP Server:

  • Name: privacyscrubber
  • Type: command
  • Command: npx -y @privacyscrubber/mcp-server

Real-World Sanitization Example

When you pass a raw configuration log:

Host: api.internal.corp
User: john.doe@enterprise.com
Client IP: 192.168.1.104
AWS Key: AKIAIOSFODNN7EXAMPLE
Secret: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Enter fullscreen mode Exit fullscreen mode

The ZTDS engine tokenizes it in < 1.5ms:

Host: [URL_1]
User: [EMAIL_1]
Client IP: [IP_1]
AWS Key: [API_KEY_1]
Secret: [SECRET_KEY_1]
Enter fullscreen mode Exit fullscreen mode

The LLM processes the code structure without ever seeing your credentials, and the response rehydrates the original keys locally on your machine.

Try the Browser Implementation

If you want to test client-side sanitization in your browser (works 100% in Airplane Mode):

How do you handle sensitive data when prompting LLMs in your daily development workflow? Let me know in the comments below!

Top comments (0)