Limitations
What Sether does not catch or promise today.
Privacy tools earn trust by being clear about their edges. These are the known limits of the current releases. When one is fixed, it moves to the roadmap as shipped.
Everywhere
Applies to: Shield, VS Code, the libraries and Sether Hooks
- It finds the types it supports, not every private detail.
- Detection is pattern- and checksum-based for each supported type. Unusual formats, new key formats and context-only secrets can slip through. Review what you send.
- Names in plain sentences need sether-ner.
- Names, dates of birth, passports and addresses are found when they appear with a label or a clear structure. A bare name in running prose needs the separate local model, sether-ner, which is an early release.
- Restoring needs the matching map.
- A real value comes back only when the reply contains a placeholder or decoy that Sether issued and its mapping is still available. If the AI rewrites or splits a placeholder, it may not be restored.
- No certification, no legal advice.
- Sether holds no SOC 2, ISO 27001 or similar certification today. Regulation mappings are engineering aids, not compliance guarantees. We will say so plainly when that changes.
Sether Shield (Chrome)
Applies to: The browser extension
- Desktop Chrome only.
- Shield runs in Chrome on a laptop or desktop. It does not run on phones, and other browsers are not supported today.
- It edits the page, it is not a network proxy.
- Shield changes the text in the AI site’s input before you send it. The AI website receives whatever you finally submit.
- Restored values are visible to the site.
- When Shield shows the real values inside a reply, they are placed in the page and may be readable by the website’s scripts. Copying a restored reply keeps them on your clipboard instead.
- Mappings last for the browser session.
- Restore works while the session that created the mapping is open.
- Supported sites can change under us.
- Shield works with ChatGPT, Claude and Gemini. When a site changes its editor or reply markup, a feature can break until an update ships, as happened with ChatGPT before 0.5.3.
- Store builds and Pro builds differ.
- Current store builds keep legacy free features. Decoys, watchlists and custom rules in Pro come with new licensed releases.
TypeScript and Python libraries
Applies to: @raeven-co/sether on npm and sether on PyPI
- Email detection is ASCII-only.
- Addresses with Unicode characters in them are not matched yet. Unicode-aware detection is on the roadmap.
- National phone formats need a region.
- +1 415 555 2671 is caught by default; (415) 555-2671 alone is not. Pass a default country to the phone detector to catch national formats.
- Card matching is permissive.
- Any 13 to 23 digits with spaces or dashes is a candidate, then checked with Luhn. Dense numeric text can produce false positives.
- Very large values across chunks.
- The streaming redactor holds back an in-progress value up to a bound. A single huge value split across two chunks can still be emitted partly. Raise safeDistanceBytes or redact complete payloads.
- Plain restore is text substitution.
- restoreSync inserts originals unescaped. For JSON, use restoreJson, which restores value by value and never restores keys.
- No published benchmarks yet.
- Throughput and accuracy comparisons with Microsoft Presidio are planned and will be committed to the repository.
Sether Hooks (coming soon)
Applies to: The prompt hook for Claude Code, Codex and Gemini CLI
- It keeps a prompt from the model, not off your disk.
- Claude Code records a blocked prompt in its local session transcript.
- It checks what you type, not what the agent reads.
- Files, tool output and attachments are not prompts and are not covered.
- Failure behaviour depends on the agent.
- If the hook cannot run at all, Claude Code stops the prompt, while Codex and Gemini CLI let it through.
Sandbox and hosted services
Applies to: The website demo and the gateway
- The sandbox is a browser demo.
- It runs a subset of the library detectors in your browser and calls no AI model. Use the server playground or the library to test the full engine.
- The hosted gateway is early access.
- It is not generally available. Stored audit trails, SIEM export and compliance reports are planned for it, not shipped.
Found a gap that is not listed?
Tell us on GitHub. For a security issue, follow the private reporting steps in the repository's security policy instead of opening a public issue.