contender

README excerpt

# secr@

`secr@` is a local-first macOS privacy tool for screen sharing. It captures a
window or display, detects sensitive content, and presents a separate sanitized
mirror that is safe to share. Capture, OCR, classification, policy state, and
redaction all stay on the Mac. After the one-time dependency and model setup,
the application works with Wi-Fi off.

> Development status: functional macOS prototype. Use the sanitized mirror as
> the shared surface; do not share the original source window.

## What it protects

- Structured secrets: email addresses, payment-card numbers with Luhn checking,
  API keys/tokens across ~25 providers (OpenAI, Anthropic, AWS, GitHub, GitLab,
  Stripe, Slack, Google, JWTs, PEM private keys, …), secret/username/password
  assignments, phone numbers, and @handles.
- OCR-damaged random credentials: an entropy/token-shape tier catches long
  mixed strings even when the OCR splits or confuses characters.
- Contextual secrets: local Gemma 4 judges ambiguous natural-language lines such
  as confidential plans, health information, or personal details.
- Sensitive applications, two classes:
  - **Vaults** (1Password, Bitwarden, Keychain, LastPass, …) get a fail-closed
    whole-app/window black mask.
  - **Messaging/email** (WhatsApp, Slack, Gmail, …) get targeted per-line
    redaction — every content line blurs, the app stays recognizable.
- User policy: custom sensitive terms and app names persist locally.

## The privacy agent

This is one determi