> ## Documentation Index
> Fetch the complete documentation index at: https://agentlogs.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Secret Redaction

> Automatic detection and redaction of secrets before upload

# Secret Redaction

AgentLogs automatically scans all transcripts for secrets and sensitive data before uploading. This ensures your API keys, tokens, passwords, and other credentials never leave your machine in plain text.

## How It Works

When you sync or upload a transcript, the CLI applies two layers of protection:

1. **Sensitive file redaction** — Contents of known secret-containing files (`.env`, `.zshrc`, SSH keys, etc.) are fully masked in `Read` and `Write` tool calls
2. **Pattern-based detection** — All remaining text is scanned for 1,600+ secret patterns (API keys, tokens, credentials)
3. **Upload** — Only the redacted version is sent to AgentLogs

<Note>Redaction happens entirely on your machine. Secrets are never sent to AgentLogs servers.</Note>

## Sensitive File Redaction

In addition to pattern-based secret detection, AgentLogs fully redacts the contents of files commonly known to contain secrets. When a `Read` or `Write` tool call targets one of these files, the entire content is replaced with asterisks while preserving whitespace structure.

### Files That Are Fully Redacted

| Category            | Files                                                                                                                   |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| Environment files   | `.env`, `.env.local`, `.env.development`, `.env.production`, `.env.test`, `.env.staging`, `.env.dev`, `.env.prod`, etc. |
| Shell configuration | `.zshrc`, `.bashrc`, `.bash_profile`, `.profile`, `.zprofile`, `.zshenv`                                                |
| Shell history       | `.zsh_history`, `.bash_history`                                                                                         |
| SSH keys            | `id_rsa`, `id_ed25519`, `id_ecdsa`, `id_dsa`, `*.pem`, `*.key`                                                          |
| AWS credentials     | `.aws/credentials`, `.aws/config`                                                                                       |
| Package managers    | `.npmrc`, `.yarnrc`, `.yarnrc.yml`                                                                                      |
| Kubernetes          | `.kube/config`, `kubeconfig`                                                                                            |
| Git credentials     | `.git-credentials`, `.netrc`                                                                                            |
| Docker              | `.docker/config.json`                                                                                                   |
| Application secrets | `secrets.yml`, `secrets.yaml`, `master.key`, `credentials.yml.enc`, `service-account.json`                              |

<Note>
  Template files like `.env.example`, `.env.sample`, and `.env.template` are **not** redacted since they typically
  contain placeholder values meant to be shared.
</Note>

### Example

```
// Original .env file content in transcript
DATABASE_URL=postgres://admin:secret@db.example.com/myapp
API_KEY=sk-ant-abc123

// After redaction (structure preserved, all content masked)
***************************************************************
**********************
```

## Pattern-Based Secret Detection

The scanner includes **1,600+ patterns** covering secrets from major services and platforms:

### AI & ML Providers

| Provider    | Pattern Example         |
| ----------- | ----------------------- |
| OpenAI      | `sk-...`, `sk-proj-...` |
| Anthropic   | `sk-ant-...`            |
| HuggingFace | `hf_...`                |
| Replicate   | `r8_...`                |

### Authentication Tokens

| Type          | Pattern Example                        |
| ------------- | -------------------------------------- |
| JWT           | `eyJ...`                               |
| Bearer tokens | `Bearer ...`                           |
| OAuth secrets | `client_secret=...`                    |
| GitHub PAT    | `github_pat_...`, `ghp_...`, `gho_...` |
| GitLab PAT    | `glpat-...`                            |

### Database Connection Strings

| Database   | Pattern Example                   |
| ---------- | --------------------------------- |
| PostgreSQL | `postgres://user:pass@host/db`    |
| MongoDB    | `mongodb+srv://user:pass@host/db` |
| MySQL      | `mysql://user:pass@host/db`       |
| Redis      | `redis://user:pass@host`          |

### Cloud & DevOps

| Service    | Pattern Example              |
| ---------- | ---------------------------- |
| AWS        | Access keys, ARNs            |
| Stripe     | `pk_live_...`, `sk_live_...` |
| SendGrid   | `SG....`                     |
| Sentry DSN | `https://...@sentry.io/...`  |
| Discord    | Bot tokens, webhooks         |
| Telegram   | Bot tokens                   |

### Generic Patterns

The scanner also detects common secret formats:

* Private keys (`-----BEGIN RSA PRIVATE KEY-----`)
* Generic API keys (`api_key=...`, `apikey:...`)
* Password fields (`password=...`, `passwd:...`)
* Secret fields (`secret=...`, `client_secret:...`)

## Length-Preserving Redaction

Secrets are redacted while preserving string length and JSON structure. This ensures transcripts remain valid and parseable after redaction.

```
// Before
"Authorization": "Bearer sk-ant-api03-abc123..."

// After
"Authorization": "Bearer ************************"
```

Structural characters like quotes, colons, and brackets are preserved so JSON remains valid.

## Pattern Sources

The scanner uses patterns from [secrets-patterns-db](https://github.com/mazen160/secrets-patterns-db), a community-maintained database of secret detection patterns.

We've added custom patterns on top for better coverage of AI tools and modern services:

| Category       | Custom Patterns Added                                                    |
| -------------- | ------------------------------------------------------------------------ |
| AI Providers   | OpenAI, Anthropic, Cohere, HuggingFace, Replicate                        |
| Authentication | JWT, OAuth client secrets, Bearer tokens, Google OAuth                   |
| Git Platforms  | GitHub fine-grained PATs, GitLab PATs and runner tokens                  |
| Database URIs  | MongoDB, PostgreSQL, MySQL, Redis, JDBC, password-in-URL                 |
| Cloud & DevOps | DigitalOcean, Vault, CircleCI, New Relic, Sentry DSN, Cloudinary         |
| Messaging      | Discord bot tokens and webhooks, Telegram bots, Microsoft Teams webhooks |
| Payment        | Stripe publishable keys, PayPal Braintree, Square                        |
| Services       | SendGrid, Mailgun, MailChimp, Shopify, Dropbox, Asana, Linear            |
| Generic        | API keys, secrets, tokens, private key blocks, certificates              |

Additional pattern sources:

* [100 Regex Patterns for Secrets](https://blogs.jsmon.sh/100-regex-patterns/)
* [secret-regex-list](https://github.com/h33tlit/secret-regex-list)

## Limitations

While the scanner catches the vast majority of secrets, it cannot detect:

* Custom or proprietary secret formats
* Secrets that don't match common patterns
* Encrypted or encoded secrets (base64-wrapped, etc.)

For maximum security, we recommend also using allowlist mode to control exactly which repositories are captured. See [Permissions](/docs/introduction/permissions) for details.