The Security Paradox

Here is the problem with most security tooling: you are supposed to trust it with your most sensitive data, yet how it works stays hidden from you.

You are evaluating a DLP product. The vendor assures you that data leaving your environment is handled according to their security standards. Their documentation says the right things. Their sales engineer knows all the compliance buzzwords. But the actual code that processes your proprietary information, the algorithm that decides what is sensitive and what is safe, the data paths that determine what gets logged and where: all of that is opaque.

You are trusting a black box to protect your secrets.

For most software categories, this is a reasonable tradeoff. You can trust your payroll system to process payroll correctly while its source code stays private. The audit mechanisms exist at the financial layer, separate from the code layer.

Security tools are different. The entire value proposition is that the tool can be trusted with sensitive data. If the tool is closed to audit, you are making an assumption about trustworthiness that the vendor is asking you to accept on faith.

Pretense's mutation algorithm is fully documented and verifiable. You can verify it yourself, with zero reliance on faith. Enterprise customers receive a full technical security review package.

What Full Auditability Gives You

You can verify the mutation algorithm.

The core concern for any enterprise evaluating Pretense is this: does the tool actually keep proprietary identifiers inside the network? Pretense provides full technical documentation of the scanner, mutation function, and identifier swap-back function. Enterprise customers can request a security review session with our engineering team.

Your security team can verify that the mutation map stays local, and confirm that the proxy keeps real identifiers out of every accessible log location. That audit takes a day.

You can verify that your data stays on your machine.

The local-first architecture is a claim we make in all of our marketing. Pretense's proxy runs entirely on your machine. The mutation map is stored in .pretense/mutation-map.json. The audit log is local. The proxy's only outbound connection is to the LLM API endpoint you configure.

You can request language support.

Pretense's scanner today supports TypeScript, JavaScript, Python, Go, and Java. If your organization uses Rust, Kotlin, C++, or another language, contact us to prioritize that scanner module.

What We Keep Proprietary

The cloud dashboard, enterprise SSO and key management, support SLAs, and managed on-prem deployment are commercial offerings. The services that run in our infrastructure and require our ongoing operation are commercial.

For enterprise security buyers, the auditable architecture is a feature of the purchase decision. You are buying support, SLAs, and managed infrastructure from us. The code that actually touches your proprietary data runs locally on your machine.

The Enterprise Buying Case

Your legal team will have three questions. Here are the answers.

Can we review it? Yes. Enterprise evaluation includes a full technical security review package. Your security team can audit before purchase, during evaluation, and at any point during your subscription.

Can we run it fully on-prem? Yes. Enterprise tier includes Docker Compose and Kubernetes Helm chart deployment for fully air-gapped environments. Everything runs on your own infrastructure.

What happens if we need to terminate? Your mutation history and audit logs are yours. They are stored locally or in your own infrastructure. You keep full access to your own compliance data, independent of Pretense infrastructure.

Your Security Team's Questions Answered

"How do we know the mutation map stays local?" The outbound connection handler accepts the mutation map as a constructor parameter and uses it to transform the request body before forwarding. The map stays in memory on your machine, outside the serialized outbound request. Enterprise customers can verify this in the security review.

"What happens if the mutation algorithm has a bug that exposes real identifiers?" All bugs are tracked and disclosed in our security advisory process. Enterprise customers receive immediate notification of any security-relevant issues.

Conclusion

Auditability in security is a mature choice. It is the correct technical and commercial decision for a tool that asks enterprises to trust it with their most sensitive data.

The mutation engine being auditable is the feature. A documented algorithm gives an attacker zero leverage. Knowing how AES-256 works leaves you unable to decrypt traffic. Knowing how Pretense mutates identifiers leaves you unable to reconstruct the mutation map. Your mutation map is the secret, and it stays on your machine.

Real security comes from architecture, and obscurity is a weak substitute. Pretense is secure because the architecture is local-first, independent of whether the algorithm is visible.

How I run Pretense on my own code

I build Pretense with Claude Code, and my sessions run through it. Here is the setup I give a new engineer, in order.

1. -Run the agent through the proxy. Type pretense run claude where you would type claude. It starts a local proxy on port 9339, points Claude Code at it and stops the proxy when the session ends. Detected secrets and PII leave the laptop as stand-in tokens.
2. -Put hooks on every repo. pretense install adds a pre-commit and a pre-push hook. A key that never lands in git is a key an agent never reads.
3. -Scan before an agent reads the repo. pretense scan path . lists what it finds. In CI, pretense scan ci exits 0 when clean, 2 on findings and 3 when it examined nothing. Treat 3 as a failure.
4. -Preview the swap. pretense review . shows what would be mutated. pretense mutate <file> --preview prints one file mutated and leaves the file on disk as it was.
5. -Round-trip a file you need to share. pretense mutate <file> --map <map> swaps the secrets in place. pretense reverse <file> --map <map> turns it back into the original, byte for byte, from the encrypted map on your machine. We run that round trip on real files before every CLI release and compare sha256 hashes.

One thing I learned the hard way: inside a session the agent sees stand-ins, so a file the agent writes can hold a stand-in where you expected a real value. Grep what the agent wrote before you ship it.

What Pretense will not do is put a secret back into the model's answer. Code identifiers come back byte-exact. Secrets and PII stay as stand-ins in the response. That is deliberate: a prompt-injected model can echo a token into a link, and reversing it there would hand over the real key.

What this means if you lead an engineering team

The outcome: your team keeps asking AI assistants about real systems, configs and connection strings, and detected secrets leave each laptop as stand-ins.

• -No new workflow. Engineers type pretense run claude in place of claude. Other AI CLIs run the same way, for example pretense run gemini.
• -Guard the repo as well as the prompt. pretense install adds pre-commit and pre-push hooks. pretense scan ci in the pipeline fails on findings (exit 2) and on an empty scan (exit 3).
• -Answers stay usable. Identifiers inside fenced code blocks go out as stand-ins and come back byte-exact, so the code the model writes still uses your names.
• -Measure before you mandate. Run it on your own repo for a week. pretense audit shows what it swapped and when.

Try it on your own repo: create a free account, then run npm i -g @pretense/cli and pretense run claude. If you need a security review first, talk to me.