Hi from Istanbul, launching tomorrow
Hey everyone, Mertcan here. I’ve been reading the forums for a few weeks and figured it’s time to say hi properly.
A bit about me: I live in Istanbul and finished computer engineering at Özyeğin University last year. Since then I am building shim.
shim started as an AI gateway: We even launched the gateway without any experience, right now we are trying to do this properly :). Companies route their LLM calls through it, and it masks personal data before anything reaches the model provider. We spent a lot of time on Turkish data specifically, things like national ID numbers and IBANs, because most tools miss them. Over time we noticed the bigger problem was employees pasting things into ChatGPT, which no gateway ever sees. So our main product now is AI Usage Control, a managed browser extension that checks prompts before they’re sent and lets the company decide what’s allowed. It’s still early and we’re testing it with the first companies.
What we’re launching here tomorrow is the smallest piece: shim-cli. It’s free, open source and runs only on your machine. It masks secrets and personal data in what Claude Code reads before the model sees it, and shows you what a session actually sent. I built it for myself after watching a full .env file go out in a request while I was debugging.
We’re four people:
Can is the man, he is both very technical and business oriented.
Turgay is a competitive programmer and the strongest engineer on the team. He’s probably inventing something new.
Öykü leads GTM. She’s been a founder since high school and keeps the rest of us organized.
Ayşenur is our designer, she designed everyting here today.
We wil be around all day tomorrow answering questions from Istanbul time. If you’ve launched a dev tool here before, what do you wish you’d known the night before?
Replies
Teammate here, glad to finally say hi. Curious about one thing: do you actually check what your coding agent sends to the model, or do you just trust it? Honestly, we used to just trust it too.
Hi Mertcan, good luck today! To answer Can's question honestly: I mostly trusted it, and solved it by making sure there's little to leak. Real secrets live in the cloud secret manager and get bound to functions at deploy, I type them in myself, so the agent never has them in a file it can read. The local .env holds only things that aren't secret. But "what did a session actually send" is a different question, and I've never really looked at that. Your token breakdown post made me check /context for the first time, so a tool that shows the requests themselves sounds useful even for people who think they're careful.
@gbasovv Thanks George, love this! Typing secrets in yourself so they never touch a file the agent can read is a really clean habit.
For the “what did a session actually send” side, shim can read your existing Claude Code history locally and show what reached the model. I’d be curious what it finds for someone as careful as you. My guess is not much!