Ziggurat Vault
shippedA local-first security gate that scrubs code before it ever goes public.
Why it exists
Anything that goes public should be intentional, not accidental. I built Ziggurat Vault so the boundary between my private workspace and the open internet is enforced automatically by a tool that runs with no network and refuses to let sensitive material slip out.
Features
Scrub before anything ships
An offline scanner reads through the code and flags personal markers, private addresses, leftover tokens and tracking hooks: the things you never want to publish by mistake.
Enforced at the last gate
It installs as a check that runs automatically before code is pushed. If it finds something it should not, the push stops.
Works with no network, ever
The whole tool runs on a machine with the internet switched off. It never makes a connection, so the workspace stays usable and trustworthy regardless of what is happening online.
Predictable and tunable
The same code always produces the same result, and the rules and exceptions live in one plain config file, not a black box.
Why I built it
The more I built, the more I cared about the moment code crosses from private to public, because that is where mistakes become permanent. A leaked address, an internal note, a stray token: once it is on a public site it is effectively forever. I did not want to rely on remembering to check. I wanted a hard boundary between my own machine and the open internet, with separation that holds whether or not there is a network connection. Keeping the working copy local and offline by default is the foundation; everything I publish has to pass through that gate on the way out.
What I worked on
I worked out what should never leave the workspace, wrote it down as explicit rules, and built a scanner that enforces them at the last step before anything goes public. When it finds a problem, the push stops. I kept it to the standard library with no outside dependencies because a tool that guards your privacy should not itself reach out to the network. The approach throughout: assume nothing, verify on the way out, make the safe path the automatic one.
$ python3 -m decon scan --staged
ZIGGURAT VAULT — PRE-FLIGHT DECONTAMINATION
──────────────────────────────────────────────────────
scanning 38 staged files...
src/config.ts:12 BLOCK private IP address (10.x.x.x)
notes/todo.md:3 BLOCK personal email address
src/api.ts:88 FLAG hard-coded token-like string
2 blocking findings — push rejected
exit 1