What JoeBro Cloak Mode redacts, and what it cannot promise

I’m Joe, creator of JoeBro and JoeBro Mobile. I added Cloak Mode because prompts can contain credentials and personal details that do not need to appear in a model request. It is enabled by default in the Mac app.

What it does

Before a request leaves the backend, JoeBro replaces recognized values such as API keys, passwords, email addresses, payment-card numbers, passport numbers, and account numbers with placeholders such as [API KEY]. The model receives the surrounding text and a placeholder in place of the matched value. That can preserve enough structure to discuss a task without sending the original secret value.

The masking applies before requests go to model endpoints, including local ones. This means a value can be cloaked even when the endpoint is Ollama on your own network. It is a consistent protection step, not a detector that decides whether a destination is trustworthy.

What it does not do

Cloak Mode does not turn a hosted API into local inference. If I choose a hosted provider, the rest of the prompt still travels to that provider. The feature also does not promise to recognize every secret or personal detail in every format. An unusual token, a project-specific identifier, confidential prose, or context that reveals a person may not match a redaction pattern. A placeholder can also change what the model can do: if the task requires the original value, the model will not have it.

For those reasons, I still choose the model endpoint deliberately and review what I am asking it to do. If I would not send a document to a particular provider, automatic masking should not be treated as permission to send it anyway. Keep keys in the app's configuration rather than pasting them into chat, and use the least access needed when an agent can read files or run tools.

JoeBro stores chats and other workspace data locally on the Mac. The iPhone companion, JoeBro Mobile, connects to that host. Cloak Mode is one layer in that setup; endpoint choice and device security still matter.