A secret is any string that grants access or identifies restricted IP. Passwords, tokens, keys, and unreleased RTL all qualify.
The list is team-owned and checked by pattern plus path. Anything matching is treated as restricted before the agent sees it.
Class | Example shape | Why it is restricted |
|---|---|---|
Credentials | Passwords and short-lived tokens | They grant access to machines or services. |
Keys and certificates | Private keys and signing material | They impersonate the owner. |
Restricted IP | Unreleased RTL and test keys | They leak product or customer data. |
Three rules keep secrets out of agent context. Never paste them in, never let tools print them, and never store them beside the task.
Redaction happens before context assembly. The agent receives a placeholder and the run continues without the value.
Rule | Practice | Checker action |
|---|---|---|
Do not paste | Keep credentials out of prompts and tickets | Deny reads of |
Do not print | Mask values in logs and diffs | Replace matches with |
Do not store | Keep secrets in a vault, not the repo | Block writes carrying key shapes. |
One deterministic pass scans text before it enters context. It counts placeholders so review can confirm coverage.
EXAMPLE scan over 200 pasted lines
credential matches: 6 lines
key-shape matches: 4 lines
restricted-path mentions: 2 lines
redacted lines = 6 + 4 + 2 = 12 lines
share = 12 / 200 = 0.06 = 6%
clean lines passed through = 200 - 12 = 188 linesThe line with the token replaced by a placeholder. The event stays readable while the value stays out.
keys/signing.pem. What is the checker verdict?Deny. Key paths are restricted regardless of approval.