Sieve – scans Cursor/Claude chat history for leaked API keys

ENTITY ANALYSIS: Sieve Secret Scanner

THE VERDICT

A well-designed tool that is simultaneously a symptom report and a decay accelerant — fixing one small crack in a hull that's already taking on water across its full length. It is indie-viable in the near term and structurally terminal in the medium term, not because it's bad software, but because the population it serves is itself a transitional artifact.

THE KILL MECHANISM

The DT logic is clean and brutal here:

1. Sieve's entire existence is predicated on human developers making mistakes. That's the threat model. Claude, Cursor, and Copilot autocomplete produce secret leakage because humans are in the loop, typing prompts, pasting values, and generating code they then deploy.

2. The loop is closing in the wrong direction for human developers. As AI coding assistants advance toward autonomous code generation, review, and deployment, the surface area for human secret-leakage shrinks. Not because security is improving — because the human who might leak a secret is increasingly not the one doing the work.

3. The product serves a decaying user base by addressing a symptom of their displacement. Developers are being pushed toward higher-level supervision of AI systems. The prompts they paste — and the secrets embedded in them — are themselves a temporary phenomenon. As agents handle more end-to-end tasks with integrated credential management, the "accidental paste into a prompt" failure mode becomes a narrower window, not a permanent feature.

4. The market that pays $9.99 for this is the same market being systematically reduced. The DT transition playbook explicitly identifies this pattern: tools addressing human error in a human-AI hybrid workflow are temporary moats. They presume a stable-ish transitional period that the thesis says is finite and accelerating.

LAG-WEIGHTED TIMELINE

Sieve is not dying today. It is correctly positioned for a narrow but real current need. But the need is structurally shrinking, not stable.

TEMPORARY MOATS

• Local-first architecture — Genuine trust signal in a market that increasingly fears cloud exposure. Strong moat for privacy-sensitive shops.
• MCP integration — This is the most sophisticated moat. Being inside Claude Code's context loop means it becomes part of the workflow, not an external scanner. This delays commoditization.
• Direct database redaction — Competitive differentiator vs. grep-based approaches. Harder to replicate with a simple shell script.
• Open-source core — Partial moat. Builds trust but also invites feature cloning.

These are real moats. They are also the moats of a company that correctly identifies the last mile of a declining market. Hospice care has excellent customer satisfaction right up until the patient stops breathing.

VIABILITY SCORECARD

SURVIVAL PLAN

Under DT transition logic, the path to longevity requires pivoting from "human developer security" to "AI-agent workflow security" — the population you serve changes, but the need (secrets hygiene) persists in a different form.

Sovereign Path:
- Absorb into AI coding platform natively. Sieve becomes the default security layer inside Claude Code, Cursor, Copilot — not an external plugin but a built-in credential governance layer. This removes the $9.99 consumer barrier and captures enterprise licensing.
- Build the secret vault as a first-class credential management standard that AI agents must query via MCP rather than storing secrets in context windows. This is the real prize — not scanning human mistakes, but enforcing AI agent credential hygiene.

Servitor Path:
- Position for acquisition by one of the AI coding platform incumbents (Anthropic, Cursor/Windsurf parent, Microsoft). The security hygiene concern is real enough that Anthropic building native secret detection into Claude Code is not guaranteed — a third-party tool with track record and trust has acquisition value.

The Hard Truth:
Sieve is a good product in a shrinking category. The DT thesis doesn't say "nothing good can be built." It says the math constrains the viable population. The market for "human developer secret hygiene tools" is real today and evaporating on a 5-10 year horizon. The pivot to "AI agent credential governance" is the survival path — but that requires competing against AI platform vendors who have every incentive to build this natively rather than pay a third party.

Build for the pivot now, while revenue funds it. The window is open. The walls are closing.