// PHASE 1–2 — S.P.E.C. + V.I.O.

The V.I.O. Interactive Sandbox

Real detection, running live in your browser. Nothing on this page ever leaves your machine.

⌘K / Ctrl+K to focus the editor · ⌘Enter / Ctrl+Enter to copy the sanitized text

[!] DISCLAIMER: This sandbox is a demonstration tool, not a certified security product. Detection is best-effort and may miss sensitive data. You are solely responsible for what you type, paste, or send anywhere, including this page. specVIO and its creators accept no liability for any loss, leak, or damage arising from your use of this tool. Use at your own risk.

SAMPLE ATTACK:

SAFE STARTER:

RAW PROMPT — EDITABLE

S.P.E.C. LIVE

SANITIZED OUTPUT — LOCAL ONLY

Analyze this quarterly summary for user [Masked_Email_1] with active credential api_key [HIDDEN_API_KEY_1]. Card [Masked_CreditCard_1] was used to confirm the wire, requested from IP [Masked_IP_1].

S.P.E.C. SCAN SENSITIVITY — MEDIUM50%

[✓] EMAIL ADDRESS[✓] API KEY / TOKEN[✓] PHONE NUMBER[✓] SSN[✓] JWT[✓] CREDIT CARD[✓] IP ADDRESS[✓] PRIVATE KEY BLOCK[ ] LABELED CREDENTIAL[ ] HIGH-ENTROPY SECRET

REDACTION:

[ Custom Patterns — Advanced ]

Add your own regex to catch things specific to you — an internal ticket ID format, a project codename, anything the built-in detectors don't know about. Stored only in this browser.

PRIVACY HEALTH

30%

DETECTED LEAKS

4 Found

RISK TIER

High Risk

INTERCEPTED THIS SESSION

[!] 4 leaks blocked. Clean & ready to copy.

[!] Exports contain the raw sensitive values found above — handle the downloaded file like the original document.

[ Batch Scan — Advanced ]

Scan several prompts at once — a backlog of drafts, or a whole day's worth — instead of one at a time.

// HOW THIS ACTUALLY WORKS

Local-Only Scanning, Explained

"Runs in your browser" is a claim anyone can make. Here's exactly what that means for this page, and where the limits are.

No network requests, ever

Detection runs as plain JavaScript in this tab. Open your browser's Network tab while you type — you'll see nothing fire. There's no server for your prompt to reach, because scanning never calls one.

Nothing is stored unless you export it

The text you type lives in this page's memory for as long as the tab is open. Refresh and it's gone. The only way anything you scan leaves this session is if you click Export or Copy yourself.

Regex, not a model

Detection is pattern matching — known shapes for emails, API key prefixes, SSNs, and so on — not an AI model interpreting your text. That means it's fast and fully offline, but also best-effort: it can miss unusual formats and occasionally flag something harmless.

Open to inspection

The detection patterns aren't a black box — the source for this exact logic lives in this site's public repo. If you don't trust a claim, verify it in code.