Skip to content
hazeliscoding.
All projects
Building nowDesktop · 2026

Carmine Workbench

Swap the secrets in curl commands and logs for labels before you share them.

View source (opens in a new tab)
Carmine Workbench — sanitize — three findings, the curl with its secrets marked, the labelled diff and the decoded JWT, on a canned sample

Sanitize — three findings, the curl with its secrets marked, the labelled diff and the decoded JWT, on a canned sample

About Carmine Workbench

A local-first desktop app that swaps the tokens, cookies and API keys in curl commands, headers, logs and JSON for labels before you share them, so the debugging detail stays. Nothing you paste leaves your PC.

When an integration breaks, you paste curl commands, headers, logs and tokens into tickets, chats and vendor support portals, and that is how credentials leak: in 2023, attackers took HAR files from Okta’s support system and used the session tokens inside them against Okta’s customers. Carmine removes what grants access, keeps what helps debugging, and shows you every change in a diff before you copy.

It removes bearer tokens, cookies, API keys, secret URL parameters, sensitive JSON keys, private keys and known key formats, and keeps the structure: the same secret gets the same label everywhere, so a reader can still follow it across requests. Any JWT it finds is explained, with its decoded claims, its expiry in plain time and warnings; it decodes tokens but never verifies them. Each rule is one folder, a small detector plus its fixtures.

It’s in early development: the screen shows a canned sample, and there is nothing to install yet. On 2026-10-24 it moved from Angular and Tauri to .NET 10 and Avalonia 12 with NativeAOT, and the engine was ported rather than redesigned: the fixtures moved unchanged, and every case must come out byte for byte as it did before. Input stays in memory only, with no history and no telemetry, and CI rejects any networking code beyond the update check.