deny.sh

sh provides deniability infrastructure designed to protect secrets managed by AI agents from prompt injection attacks. The platform introduces an architectural layer that ensures, if an agent is compromised and leaks a credential, only a shape-correct, validator-gated decoy is exposed rather than the actual secret. This approach makes credential leaks survivable and immediately detectable, rather than attempting to prevent all leaks outright.

The system works by equipping each agent with decoy bundles for each tenant, covering credentials such as OpenAI keys, AWS credentials, Stripe secrets, JWTs, recovery phrases, and Postgres URIs. These decoys are structurally indistinguishable from real secrets and act as silent tripwires. If a decoy is accessed, the platform triggers a critical event before any response is returned, alerting the on-call team via integrations with Datadog, PagerDuty, or Slack, typically within about five seconds. For programmatically managed secrets, a rotation hook can be fired instantly to revoke the real key before anyone reads the alert, providing automatic containment.

sh implements per-tenant isolation, so each tenant receives a unique decoy bundle, and any breach is limited to a single tenant's decoys rather than affecting the entire user base. The platform maintains a hash-chained, RFC 3161 timestamped audit log for every encryption, decryption, and key access, creating a tamper-evident chain that can be independently verified by regulators. The real keys are never present in the AI model's context; instead, the agent holds a reference, and the actual credential is resolved only within a trusted runtime boundary for legitimate operations. This design ensures that only decoys are ever exposed to injectable contexts, while real credentials remain secure.

sh is positioned for engineering teams developing AI agents that manage sensitive secrets for multiple users. It is open source and offered as a free-forever solution, and is compatible with existing secrets managers such as AWS KMS and HashiCorp Vault. The platform is available via web dashboard, Chrome extension, CLI, and Telegram bot.