Core is the floor, not the sample.
Core masks recognized known-format matches in supported request bodies before your configured upstream sees them, and it does that without an account or an expiry date. Here is what it does not do yet, and what I am doing about it.
What is in the works
I am working on detection that does not depend on a known key format, and on looking at what comes back, not just what goes out. That is as specific as I am willing to be while it is unfinished, because a list written today would be a promise I have not earned yet.
Keep doing the careful thing
Read what you paste and keep secrets out of prompts on purpose. Promtect is the backstop for the one that gets past you on a Friday afternoon, not a reason to stop looking.
Where this stands
Nothing described here is available yet. There is no account and nothing to install. Leaving your email puts you on a list and does nothing else, and you will hear from me when there is something real to try.