Developer Tools · sub-niche
Secret scanners for LLM logs.
LLM logs and traces are leaking secrets at scale. Scanners that catch them at the SDK boundary are an unbuilt layer.
Why now
Every observability tool stores prompts and completions. Secrets leak into both. Regulated industries are starting to ask.
What the signal looks like
Repos with regex + entropy + ML detector trios, integration adapters for the top LLM SDKs, and compliance frameworks (SOC2 / HIPAA / GDPR) called out in the README.
Public examples
We name publicprojects + categories only — never founders we track inside the paid product. The buyer’s edge stays inside the product.
- TruffleHog-style scanners adapted to LLM payloads
- Detect-secrets forks with PII + secret detectors
- Lakera-style guard frameworks for outbound logs
What this displaces
A regex grep over the log stream + crossed fingers.
Our build-vs-invest call
SDK-level injection wins. Customers want a 2-line install. Pricing is per LLM call scanned. Watch for repos that ship adapters for OpenAI, Anthropic, and the major observability tools (Langfuse, Helicone, Datadog) in the same release.
Common questions about this niche
- Isn't this a feature of observability?
- Some observability tools ship this. But the standalone scanner that runs across all of them is a different shape.
- What's the compliance angle?
- EU AI Act + sectoral regulation. Buyers are CISOs at AI-adopting enterprises.
- Is this a feature?
- Feature today, product tomorrow, platform when extended to image/video.
More inside Developer Tools
- Code review for mobile — Mobile is where review tooling broke first — phone screens, swipe-friendly diffs, async patterns.
- AI pair-programming CLI — Terminal-native AI coding — Aider, Plandex, Claude Code shape — minus the IDE lock-in.
- Terraform alternatives — HashiCorp's BSL license cracked the door — multiple credible forks and rebuilds are now real businesses.
- Postgres clients for AI — AI apps mostly fail at Postgres — connection pooling, prepared statements, vector indexes. There's a clean client to be built.