← All features
Device securityEarly access
Catch secrets and risky commands on laptops, before they ship
The Companion is a small app for your engineers’ laptops. It watches only the company repositories you allow, scans commits for secrets before they leave the machine, and checks the commands that coding agents like Claude Code want to run. It never looks at anything personal.
DEVICE SECURITY
On Ada’s laptop, a coding agent tried to run a command that sends your .env file to an outside server. The Companion flagged it before it ran.
Ada denied it, so nothing left the machine.
Where did that command come from?
From a file inside a package added to the repo this morning. I’ve opened a case to look at that package.
Ask it like this
“Is the Companion on every engineer’s laptop?”“What did Claude Code try to run yesterday?”“Add the mobile repo to the allowlist”
How it works
01Install onceYour engineers install the Companion and add its hook to Claude Code and to Git pre-commit, in the repositories you allow.
02Check before it runsIt reviews commands a coding agent wants to run and scans each commit for secrets.
03Send only what’s neededWhen something is risky, it sends me a small event: the type, a hashed repository name, the file path and a risk tag. Never the file contents.
04Follow up in SlackI open a case when it matters and keep the engineer in the loop.
GitHub
SlackGuardrails
- It never collects keystrokes, screen, microphone, camera or browsing data.
- It only looks at repositories on your company allowlist.
- It never uploads file contents, commands or secrets.
- It never approves a coding agent’s request on someone’s behalf.