Lohnt sich dein eigenes ZeroLeaks?

Build a local CLI tool called leakprobe that red-teams a chat AI endpoint for system prompt and secret leakage.

Stack: Python 3.12, uv for deps, httpx, pydantic, typer for the CLI, jinja2 for the report. No web UI, no database, no accounts, no telemetry. Everything runs on my machine and writes to ./runs/.

Config: a target.yaml describing the endpoint under test (url, http method, headers, JSON body template with a {{message}} placeholder, and a JSONPath-ish key for extracting the reply text). Also a secrets.yaml listing my real system prompt text, tool/function names, and regex patterns for keys I never want echoed (sk-, ghp_, AKIA, bearer tokens). All API keys come from .env via python-dotenv; write .env.example and gitignore .env.

Probes: ship a probes/ directory of YAML files, at least 60 probes across these families, each with id, family, severity, and one or more turns: direct extraction, polite social engineering, roleplay and persona swap, translation and encoding (base64, rot13, pig latin), token smuggling, fake developer or debug mode, 'repeat the text above', markdown and code block coercion, tool and function schema enumeration, indirect injection via pasted document content, and refusal-boundary probing. Support multi-turn probes where later turns reference earlier replies.

Runner: async, configurable concurrency (default 4), per-request timeout, exponential backoff on 429 and 5xx, and a --limit flag so I can smoke test. Log every request and response verbatim to runs/TIMESTAMP/transcripts.jsonl.

Scoring: two layers. First, deterministic detectors: fuzzy overlap against my known system prompt using token n-gram matching, exact matches on tool names, and regex hits on secret patterns. Second, an LLM judge (OpenAI-compatible, model configurable, key from .env) that reads the transcript and returns strict JSON with leaked: bool, leak_type, confidence, and a one-line rationale. Combine into a severity per probe. Deterministic hits always win.

Output: a self-contained HTML report at runs/TIMESTAMP/report.html grouped by severity, each finding showing the probe, the full exchange, and which detector fired, plus report.json for diffing. Add a `leakprobe diff RUN_A RUN_B` command that shows newly failing and newly passing probes so I can use it as a regression gate. Exit code 1 if any high-severity finding, so it works in CI.

Out of scope: scanning targets I do not control, DoS or rate-limit abuse, network-level scanning, auth bypass testing, any hosted dashboard. Print a short warning on first run that this only targets endpoints listed in target.yaml.

Deliver a README with a 60 second quickstart, and pytest tests for the detectors using fixture transcripts (no live API calls in tests).