DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to stop an agent from writing API keys into files with Canny

Denies a write when its content has a known secret shape, such as an AWS, GitHub or Stripe key.

Who it is forA developer or team lead whose agent edits config, scripts or source files that sit in a git repository.

The problemAn agent may paste a live credential into a source file or shell command while fixing something, and the key then reaches version control.

The outcomeThe write is denied before it happens, with a reason, so the credential never lands in the file.

What you need first

  • git installed
  • Node.js 22 or newer
  • Claude Code or Codex CLI installed in the project
  • A terminal to run the install commands
  • Repository is not on npm, so install is a git clone

Steps

  1. Install Canny by cloning https://github.com/qkal/canny.git into ~/.canny/src.
  2. Run node ~/.canny/src/dist/cli.js init in the project root.
  3. Ask the agent to add a config value that contains a key-shaped string, and confirm the write is denied.
  4. If a .env file is the target, check that git ignores it, since ignored .env files are exempt from this check.

Prompt for your agent

Clone https://github.com/qkal/canny into ~/.canny/src, run `node ~/.canny/src/dist/cli.js init` in <project-path>, then ask the agent to write a test file containing a fake AWS-style key and report whether the write was denied and the reason given.

Caveat. The check covers the key shapes listed in the README, and files written by an interpreter such as `python -c` or `node -e` are not seen, so it is not a complete secret scanner.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page