Lostop
Local-first DLP for GenAI chat

Your prompt leaks the moment you hit Enter.Lostop stops it first.

A browser extension that checks your text before it reaches ChatGPT, Claude, or DeepL — and blocks the part that shouldn't leave your machine.

Get Lostop View source on GitHub
Checked locally · nothing goes to the cloud · free & open-source
Runs on top of the sites you already use. A secret pasted once can't be taken back — no service will purge it from its logs on request.
chatgpt.com claude.ai deepl.com
How it works

Three steps, none of them cloud-based

Lostop doesn't change how you type — it just stands between your input field and the network.

01

Type as usual

Lostop watches the input field on the page — not your screen, not your clipboard, just what you actually type into the chat.

02

Local check

The moment you hit send, the text is checked against known leak patterns right on your machine — not a single character leaves for the check itself.

03

Pass or block

Clean, and the message goes through as usual. A secret is found, it's highlighted right in the field, and the request is stopped.

What it catches

18 secret types, and growing

From cloud credentials to payment keys — detected locally, with card numbers checksum-validated to keep false positives down.

API key
sk-████████████████
AI provider keys
Private key
-----BEGIN ██████████
RSA / EC PEM keys
Card number
4111 4111 █████████
PAN, Luhn-validated
Database URI
postgres://user:██████
Connection strings

Cloud & source control

AWS Access Key GCP Service Account GitHub PAT GitLab PAT

AI providers

OpenAI API Key Anthropic API Key Hugging Face Token

Databases

PostgreSQL URI MySQL URI MongoDB URI

Payments, auth & keys

Stripe Live Key Stripe Test Key JWT Token RSA / EC Private Key

Team tools

Slack Webhook Discord Webhook Discord Bot Token

Financial

Card Number (Luhn-validated)
Full list, updated as it grows: 18 signature types — defined in backend/main.py
Dashboard

See what's been blocked, without leaving your machine

An optional local dashboard reads the same local database Lostop writes to — filterable by day, week, or month.

Built with Streamlit, running on the same machine as the server — no account, no cloud sync, no data leaving your device.

  • Filter by today / 7 days / 30 days / all time
  • Breakdown of incidents by secret type
  • Daily timeline showing trends over time
  • One-click launcher (start-dashboard.bat) — no terminal required
Install

Two ways to get set up

Pick prebuilt binaries if you just want it running, or build from source if you're a developer.

Local server lostop-server.exe Standalone Windows binary, no Python required
Download Server (.exe)
Browser extension extension/ Load unpacked into Chrome — details below
Download Extension
Recommended

Automatic setup

Prebuilt binaries — no Python, no terminal.

  1. Download the extension lostop-main.zip →
  2. Download and run the server lostop-server.exe → No console window — it just starts working in the background.
  3. Load the extension folder into Chrome — see details below
  4. Done — open ChatGPT, Claude, or DeepL
For developers

Manual setup

Run the Python source directly.

  1. Clone the repo
    git clone https://github.com/wowkamran/lostop.git
  2. Run the server from source
    cd backend
    pip install fastapi uvicorn
    uvicorn main:app --host 0.0.0.0 --port 8000
  3. Load the extension folder into Chrome — see details below
  4. Done — open ChatGPT, Claude, or DeepL
Why isn't this a one-click "Add to Chrome" install? Chrome only allows one-click installs for extensions listed on the Chrome Web Store. Lostop's listing is currently pending review — once approved, the extension step below will no longer be necessary.

Loading the extension into Chrome

  1. Open chrome://extensions in Chrome (or any Chromium-based browser — Edge, Brave, Vivaldi all work the same way).
  2. Turn on Developer mode using the toggle in the top-right corner.
  3. Click Load unpacked.
  4. Select the extension folder from the files you downloaded.
  5. You should see the Lostop icon appear in your extensions list — that's it.

Keeping the server running automatically

  1. The server needs to be running whenever you want protection active.
  2. To avoid starting it by hand every time, add it to Windows Task Scheduler with an At log on trigger — then it's a true "set it once and forget it" setup.