Share Scrub: catch secrets and personal data before you share an AI chat link
A browser extension that scans a chat locally before you share it. Freelancers and consultants pay a small subscription.
Competitive · Muse shared chats exposed user secrets
Written for: Solo builder
Next step
Build a Chrome extension for the two biggest assistants that scans for API keys, emails and phone numbers before share, and post it as a free tool in the Muse HN thread and r/privacy.
Why now
Every major assistant offers share links, and this incident shows people click share without rereading the transcript. Enterprise DLP sells to IT departments, and nothing sits in front of an individual at the moment they share.
What became possible
A Hacker News report says Muse exposes users' personal and business secrets when they share conversations. Detecting keys, tokens, emails, addresses and account numbers with regex, entropy checks and a small local model is mature, cheap technology.
Three ways in
- Share Scrub extension
Intercepts the share button on ChatGPT, Claude, Gemini and Muse, scans the transcript in the page, highlights hits and offers a redacted copy or a cancel.
- Customer
- Developers, freelancers and consultants who paste client material into chats
- Model
- Free core. $4/month pro with custom patterns
- Link audit
Lists your existing public share links on each platform and re-scans them, so you can revoke the risky ones.
- Customer
- Same users after reading about the incident
- Model
- Pro feature
- Team patterns
Shared custom patterns, such as client names and internal hostnames, for small agencies.
- Customer
- Agencies of 5 to 20 people
- Model
- $5/seat/month
Competition
Two caveats. Each platform's share flow and link-management pages change often, so the integrations will need ongoing maintenance. And I couldn't confirm what "Muse" refers to as an AI chat platform.
Full competition notes (8 competitors)
Scanning prompts locally before you send them is already crowded. Offsend, promptShield and Prompt Armour cover individuals, while Nightfall, Harmonic and Strac sell to companies. All of them check what goes into the AI. I found no product that steps in at the share button and checks the whole conversation, including the AI's replies and anything pasted earlier, before a public link is created. I also found nothing that lists your existing share links across ChatGPT, Claude and Gemini and re-scans them for secrets. The bulk-delete extensions only clean up chat history, and the built-in share-link pages are manual, one platform at a time, and don't look at content. The timing helps. ChatGPT shared chats showed up in Google in August 2025, and Claude shared chats were indexed in July 2026, with reports of API keys and medical reports in them. The Link audit is probably the strongest wedge: it is easy to explain, it is the job people are scrambling to do right after an incident, and nobody seems to sell it. There are three risks. First, the moat is thin, because any of the prompt-scanning extensions could add a share-button hook in a few weeks. Second, the platforms could add their own warnings at share time. Third, users don't trust extensions that read AI chats, after the Chrome extension caught harvesting conversations from 900,000 users. To answer the trust problem, keep the code open-source or auditable and request minimal permissions. Team patterns for small agencies, such as client names and internal hostnames, give you a defensible paid tier, because the consumer tools don't target that and enterprise DLP is too expensive and heavy for a 5 to 20 person shop. Two caveats. Each platform's share flow and link-management pages change often, so the integrations will need ongoing maintenance. And I couldn't confirm what "Muse" refers to as an AI chat platform.
- Offsend (Lab13)
Firefox add-on. Its listing says it detects API keys, tokens, private keys, passwords and personal data locally as you type in ChatGPT, Claude, Gemini and others, and masks them with reversible mappings. It checks prompts before you send them, not shares, but it uses the same local detection engine Share Scrub would need.
- promptShield
Free, offline Firefox add-on. It swaps names, emails, phone numbers and account numbers for stable codes before text goes to the AI, then restores the real values in the reply. It works on prompts, not share links.
- Prompt Armour
Launched on Product Hunt. It catches and redacts sensitive data in real time inside ChatGPT, Gemini and Claude before you hit send, using regex, entropy checks for API keys and lightweight NLP, all in the browser. Its pitch to individuals is close to Share Scrub's.
- Nightfall DLP for Browsers
Enterprise data loss prevention (DLP) extension for Chrome, Chromium and Firefox. It finds personal, payment and health data plus secrets in ChatGPT and other AI apps and redacts before you submit. Per its own documentation it only monitors Claude and does not redact there. It is sold to companies, not freelancers.
- Harmonic Security
Enterprise browser extension and desktop agent that uses small language models to judge how risky data sent to ChatGPT, Copilot and Gemini is. It is aimed at security teams.
- Strac
Enterprise DLP with a browser extension that warns, blocks or redacts sensitive prompts and uploads before they reach Claude and other AI tools. It covers prompts, not share links.
- AI Bulk Chat Manager and similar bulk-delete extensions
Chrome extensions such as AI Bulk Chat Manager, AI Chat Sweep and DeclutterGPT that bulk delete or archive chats on ChatGPT, Claude, Gemini and Grok. They clean up chat history but do not list, scan or revoke public share links. They show that cross-platform extensions can manage your account on each site.
- Built-in shared-link managers in ChatGPT and Claude
ChatGPT (Settings, Data controls, Shared links, Manage) and Claude (Settings, Privacy, Shared chats) let you list and revoke links by hand, one platform at a time, with no content scanning. This is the free baseline that the Link audit feature has to beat.
Checked 2026-10-21
Risks
- Evidence is a single HN thread, so check the scale of the incident first
- Platform DOM changes break interception often
- Assistants may add their own pre-share warnings
- Consumer willingness to pay for privacy tools is low
Strong tech readiness and team fit; market pull is the weak point (4).
tech 9 · pull 4 · space 6 · fit 9 · build 9
Exposed
Companies that could benefit or be threatened. News and context, not investment advice.
Momentum of its main topic
Sources
Status history
- 2026-10-21 Flagged as buildable