So, @OpenAI just shipped privacy-filter: a local 1.5B-param model for detecting PII & credentials.
As a first experiment I created 'git-privacy-filter', a simply git pre-commit / pre-push hook tool that refuses to commit anything it flags (link in first reply).
