A key in a chat window is a key on someone else's server.
An engineer debugging at speed pastes a config to ask what is wrong with it, or drags a file into a converter site. Both are a few seconds of work and both are outside every tool you already own, because they never touch your network.
The shapes that ship, and the ones only you know
Access keys and private key blocks are recognised out of the box. Your own internal tokens are a sentence away: describe the shape and Generate with AI drafts the pattern, with an example it must catch and one it must ignore.
- Block is the sensible answer for a secret, and it is the one action the person cannot click through.
The same code, dragged instead of pasted
Upload rules take a file type or a file extension, so a repository file, a database dump or an export can be refused before the upload starts. Downloads work the same way in the other direction.
- Both forms matter here: browsers report no type at all for a lot of source files, which is why extensions exist alongside types.
text/x-pythonapplication/sql
.sql.env.pem
Your own repository is not the problem
Whitelist the hosts where code is supposed to live and Capsulla does nothing there at all — no checks, no events — so the rules only ever bite where the code should not be going.
Worth knowing
- Patterns are evaluated on the device. A key that matches is counted, never collected.
- File rules only block. There is no warn or mask for a transfer, because a file is either sent or it is not.
Other things people move
Stop the next leak before it leaves the browser.
Try it free for 14 days, no card needed. Start with one team and see what Capsulla catches in the first week.