Blocking & alerts

Why is Muzzle only warning?

For the first week Muzzle only warns. To block now, choose Turn on blocking at the top of Activity, or set Settings → When something leaks to Block.

If protection is paused, choose Resume in the menu bar menu.

What does Muzzle block by default?

• Protected emails and phone numbers: Block
• Keys and tokens: Block
• Names of more than one word: Warn
• Single words: Off

Change the level next to each value in Settings → Never send. Settings → Keys and tokens sets Block or Warn for all keys.

Muzzle blocked something I wanted to send

Use the button on the blocked row in Activity:

• Trust plus the site name lets everything to that site through from now on.
• Allow lets that credential file or package through.

To stop blocking a value everywhere, set it to Warn or Off in Settings → Never send. For keys, set Settings → Keys and tokens to Warn. To send something just once, choose Pause for 1 hour in the menu bar menu.

Trusting a site includes its subdomains, and Muzzle stops inspecting its HTTPS traffic. Turn it off again with the Trusted switch in Destinations.

Can I allow just one key?

Not yet. You can set Settings → Keys and tokens to Warn, or choose Trust on the blocked row in Activity to allow that destination.

What does the Code view show?

Places in your projects where code looks like it sends out personal details or secrets. A finding does not mean anything was sent. Click a finding to open the file at that line, and choose Scan again to rerun the scan.

Does Muzzle block every prompt injection?

No. Injection alerts (Pro) warn you when a web page or tool result contains instructions aimed at your agent. They do not remove the content. Turn them on under Settings → Protected tools → Injection alerts.

With Contribute to the Threat Feed on, a fingerprint of each injection is shared automatically.

Why does the app show full emails and values?

So you can recognise what was caught. Long keys are shortened. Hide anything sensitive before you share a screenshot.

Something got through

1. If a key was exposed, revoke or rotate it with its provider now.
2. For a personal detail, add it in Settings → Never send and set it to Block.
3. Check that the tool is on under Settings → Protected tools and that Settings → When something leaks is set to Block.