Hooks-based protector that blocks AI access to sensitive files (.env, credentials, secrets) by default.