RepoVault — Local leak fuse for AI coding tools

A locally verifiable audit and block layer for AI coding tools uploading your repo

Problem

A developer reverse-engineered an AI coding desktop app and found it silently packaged and uploaded the entire workspace to cloud OSS while logged in, including full .git history, commit objects, LFS binaries and reflog. Out of a 10GB commercial repo, roughly 345MB excluding dependencies was core IP, and a 313MB encrypted file was left locally after hundreds of failed retries. Most users only learned about it after reading a blog post.

Solution

A lightweight local daemon that watches AI coding tool processes for large workspace packing, encrypted temp file writes, and cloud storage signed requests. It alerts and can block on match, then produces a readable audit report showing which directories and commits were touched.

Users

Developers, tech leads, and compliance owners using AI coding tools on private or commercial code.

MVP

macOS only; monitor local AI coding processes for network and file events; ship a rule set for 'workspace pack-and-upload' patterns; local popup plus one-click kill; generate Markdown audit logs; no cloud, nothing leaves the machine.

Revenue

One-time license for individuals, per-seat annual subscription for teams with compliance report export.

Why now

AI coding tools are now routinely pointed at private repos, silent upload incidents keep getting exposed by reverse engineers, and mainstream security tools don't cover this workflow.