AI Upload Guard — why I built it (and how to use it)

Most “don’ts” in security are learned the hard way.

I kept seeing the same pattern: someone shares a file with an AI tool or a vendor portal and only later realizes it contained API keys, client identifiers, or internal network details. Not malicious—just fast. Too fast.

So I built AI Upload Guard: a local pre-check you run before you upload.

It’s not DLP. It’s not compliance. It’s a speed bump that catches the obvious stuff and makes you pause long enough to think.

What it does (in plain terms)

• Stays local. No network calls. It reads your file, scans it, and prints a summary.
• Looks for the usual foot-guns:
  • PII: emails, phone numbers (with context gating), SSN-like strings, address-like lines
  • Financial markers: strict credit card checks (Luhn), IBANs, bank hints
  • Secrets: AWS keys, tokens, JWTs, password fields, and more
  • Source code fragments and stack traces you probably didn’t intend to share
  • Network details: IPs, CIDR blocks, host:port, URLs, cloud resource IDs
  • Client/internal markers: names you define, “CONFIDENTIAL”, “INTERNAL USE ONLY,” etc.
• Masks samples by default so you don’t paste sensitive strings back into logs.
• Gives a simple disposition: ALLOWED_*, RESTRICTED, or PROHIBITED (with exit codes for CI).

It’s “advisory,” on purpose. You still own the decision.

How I use it (Windows, macOS, Linux)

1. Install dependencies for your file types:

   • PDF: pip install pdfminer.six
   • DOCX: pip install python-docx
   • Excel: pip install pandas openpyxl

2. Run a scan:

   python ai_upload_guard.py path/to/file.pdf
   

3. Tighten the rules when needed:

   # Treat restricted as prohibited (stricter)
   python ai_upload_guard.py report.docx --strict
   
   # Escalate network details to prohibited
   python ai_upload_guard.py export.txt --ip-as-prohibited --hostnames-as-prohibited
   
   # Flag your org/client names and mark context of the file
   python ai_upload_guard.py notes.md --client-names "Acme|Contoso" --context client
   

4. Integrate in CI or pre-commit:

   # JSON output + stable exit codes (0/2/3)
   python ai_upload_guard.py sample.md --json --acknowledge-risks
   

Tip: add an ignore list for known benign hits:

python ai_upload_guard.py doc.txt \
  --ignore "(?:dummy|example)@example\.com" \
  --ignore-file .ai-guard-ignore

What it doesn’t do

• It won’t upload, “clean,” or rewrite your files. The goal is awareness, not magic.
• It won’t replace a security review. Think of it as a guardrail before the highway on-ramp.
• It won’t call home. No telemetry, no web requests.

If you need DLP, use DLP. If you need a quick sanity check before you paste a log into an AI window, this is it.

Lessons learned building it

• Fast is not the same as safe. Tools are eager to “make it work.” Humans must protect the context.
• Masking by default matters. It prevents re-exposure in terminals, CI logs, and screenshots.
• Clarity beats cleverness. A few good heuristics + clear CLI options > a black-box “classifier.”
• Make it easy to say “no.” Exit codes and --strict flags let teams draw the line where they need it.

Have an idea? Open an issue or send a PR.

Try it

Run it on something you’re about to share. If it catches nothing, you get confidence. If it flags something, you just saved yourself a headache.

Small tool, big habit change.