Fact sheet · Cybersecurity
Stroq
Find and prevent secrets and prompt injection attacks in AI coding agent sessions
Local, open source tool that scans recorded Claude Code, Codex CLI and Cursor sessions for known credentials and guards against prompt injection and secret
Overview
Stroq is a security tool for developers who run AI coding agents in their repositories. It scans recorded sessions from Claude Code, Codex CLI, and Cursor to find known credentials and sensitive data, displaying their locations without revealing values. The tool uses two hooks with a deterministic policy: normalization (stripping zero-width characters and decoding hidden encodings), provenance (tracking where data came from), and a secret egress guard that blocks outbound calls carrying known secrets by their hashed values.
Stroq replayed 36 real and modeled attack scenarios, blocking 15 and prompting for 21, with none passing through. It provides a local console at 127.0.0.1 with full audit trails and decision explanations, never involving a model or network in the guard's hot path. The tool runs locally with no telemetry, operates under Apache-2.0 license, and is built in the open by one developer.
Feature facts
- Scan recorded AI agent sessions for known credentials
- Guard against prompt injection attacks
- Local console with audit trails at 127.0.0.1
- Support for multiple AI coding agents including Claude Code, Cursor, and Codex CLI
- Default policy with 21 rules across 19 action classes
- Test policy against replayed attack scenarios
- No model or network in the guard's hot path
Pricing
Pricing model: Open source
Follow Stroq: their milestones, new launches and awards come to you by email, once a day by default.
Stroq specifications
| Section | Cybersecurity |
|---|---|
| Website | stroq.dev |
| Votes2 | 0 |
Stroq metrics
| Metric | Value |
|---|---|
| Domain Rating | 4 +2 (up) since last check |
| Trust Flow | 1 no change since last check |
| Citation Flow | 15 no change since last check |
| Referring domains | 43 no change since last check |
| External backlinks | 97 no change since last check |
Fact: Ahrefs Domain Rating checked 12 Nov 2026, fact changed 11 Nov 2026. Fact: top topic Science/Environment (1). Fact: Majestic checked 1 Nov 2026, fact changed 1 Nov 2026. Link facts from Majestic. Trust Flow, Citation Flow and Topical Trust Flow are trademarks of Majestic-12 Ltd.
Stroq domain fact sheet
Open the fact sheet
| Domain age | 2 months |
|---|---|
| Registered | |
| Expires | |
| Registrar | Name.com, Inc. |
| DNSSEC | Not signed |
Stroq launch receipt sheet
What we have measured for Stroq since it went live on SaaS Directory Info on 1 November 2026.
- 4 Domain Rating (Ahrefs) +4 (up) since launch
at launch: 0 (1 Nov 2026); latest: 12 Nov 2026 - 1 Trust Flow (Majestic)
first measured 1 Nov 2026 - 43 Referring domains (Majestic)
first measured 1 Nov 2026
Day 10 since launch. Next receipt: day 30, 1 Dec 2026. The figures report a change; they do not say what caused it, and many things can. No figure here is a guess.
Got a launch coming up?
Step-by-step tips for before, during and after your launch, free to read on SaaS Directory Info.
- Prepare
- Launch day
- Launch week
- Next steps
Compare and explore
Frequently looked up
- Q1What attacks does Stroq protect against?
- Stroq protects against 36 documented attack scenarios including code execution, credential theft, data loss, persistence mechanisms, guard removal, and memory poisoning. These attacks are replayed on every commit and tested against the policy.
- Q2How does Stroq avoid false positives?
- Stroq uses a deterministic policy without a model in the loop. When blocking an action, it shows the origin and context (which file, which rule, how long ago), and one explicit command can clear a false positive.
- Q3What AI agents does Stroq support?
- Stroq scans Claude Code, Codex CLI and Cursor sessions, and also supports Copilot CLI, Windsurf, Antigravity, OpenClaw and any stdio MCP client.
- Q4Does Stroq require internet or send data to a server?
- No. Stroq runs locally with no network in the hot path and no telemetry. The console is loopback only at 127.0.0.1, requires no account, and no data is sent externally.
- Q5Can the policy be customized?
- Yes. The default policy has 21 rules across 19 action classes. Users can copy the policy to ~/.stroq/policy.yaml and edit it, and each scenario is replayed through the policy on every commit.
Leave a review for Stroq
Review count for Stroq: none yet. Add the first.
Fact: reviews are free and cannot be bought. All reviews, in brief
Reviews and facts · Fact updates · Share these facts · Your SaaS? Claim this fact file · Report a wrong fact
Stroq has a free listing. The owner can unlock the full profile with a paid launch for $5:
- Founder story (locked)
- Milestones (locked)
- Demo video (locked)
- Dofollow website link (locked)
See also
| Product | Origin | DR1 | Votes2 |
|---|---|---|---|
 T4X ProtectionDefense at the Atom | Bangladesh | 0 | 0 votes. Log in to vote for T4X Protection in the file |
 VeilleStop bots and account abuse in minutes | France | 22 | 0 votes. Log in to vote for Veille in the file |
 KairalBot protection and fraud prevention for e-commerce sites and marketplaces | Italy | 6 | 0 votes. Log in to vote for Kairal in the file |
 falc0nIndependent security researcher mapping India and APAC's exposed attack surface at internet scale | India | 0 | 0 votes. Log in to vote for falc0n in the file |