redacted

Your never reach the model.

A local hook scrubs every tool result before your coding assistant reads it. It catches vendor keys, the secrets you teach it from your .env, and, if you turn it on, random-looking values.

$ curl -sSL https://raw.githubusercontent.com/svn-arv/redacted/main/install.sh | sh
GitHub
PostToolUse hook2 secrets scrubbed
$ heroku config -a billing-prod
DATABASE_URL: postgres://billing:EXAMPLEPASSWORD@db-1.internal/billing DATABASE_URL: [REDACTED:database_url ...ling]
NEW_RELIC_LICENSE_KEY: NRAK-EXAMPLEKEYEXAMPLEKEYNRAK NEW_RELIC_LICENSE_KEY: [REDACTED:newrelic_key ...NRAK]
RACK_ENV: production
Scanned on your machine. Clean lines pass through byte for byte.

Nobody has to run a dangerous command.

The model knows not to run cat .env. Keys get in through ordinary output instead.

They ride along in ordinary output.

A committed key in git diff. A token in a log line. A stack trace that dumps the environment on its way out.

Some commands exist to print them.

heroku config, kubectl get secret, aws secretsmanager get-secret-value. Running them is the job, not a mistake.

Command guards read the wrong thing.

Deny lists and model judgment inspect the command string. An npm script, a make target, or a proxy CLI changes the string. The output is unchanged.

Once a secret is in context it is in the transcript on disk and in every request that follows. redacted does not judge commands. It scrubs the output, whatever produced it.

Bash, Read, Grep, WebFetch → redacted scrub → context window
Bash: git diff config/staging.env3 secrets scrubbed
Without the hookdiff --git a/config/staging.env @@ -3,6 +3,7 @@ REGION=eu-west-1 POOL_SIZE=12 -AWS_ACCESS_KEY_ID=AKIAEXAMPLEKEYID0001 +AWS_ACCESS_KEY_ID=AKIAEXAMPLEKEYID0002 +GITHUB_TOKEN=ghp_EXAMPLETOKENEXAMPLETOKENEXAMPLETOKEN LOG_LEVEL=info
What the model receivesdiff --git a/config/staging.env @@ -3,6 +3,7 @@ REGION=eu-west-1 POOL_SIZE=12 -AWS_ACCESS_KEY_ID=[REDACTED:aws_access_key ...0001] +AWS_ACCESS_KEY_ID=[REDACTED:aws_access_key ...0002] +GITHUB_TOKEN=[REDACTED:github_token ...OKEN] LOG_LEVEL=info

Three tiers, run in this order.

Signature and learned hits name what matched, as in [REDACTED:aws_access_key ...0001]. Keyed and entropy hits keep the key instead, as in KEY= [REDACTED ...abcd].

46 built-in patterns

Vendor signatures

AWS, GitHub, Stripe, OpenAI, Anthropic, Slack, Twilio and more, matched on each key's prefix and shape. Add your own in engine.yml.

0 plaintext values stored

Learned secrets

redacted init learns the values you pick from your .env and stores only a sha256, a length and, for prefixed keys, a shape. It replaces the keyword rules of 0.7.

3.5 bits per character

Entropy heuristic

Off by default. When enabled, a KEY=value pair is redacted if the value runs 16 to 128 characters, mixes lowercase, uppercase and digits, and reaches this entropy.

Some of the signatures.

The README lists all 46 patterns. Hover or tap a block to reveal it.

What it will not do.

Reach the network

A single Rust binary that runs on your machine. No calls out, no telemetry, no account.

Fail open

If the hook errors, the output is withheld rather than passed through raw.

Store a value

Stats keep a timestamp, the tool name and per-pattern counts. Learned secrets are stored as a sha256 and a length. Never the text itself.

Leave you guessing

The last four characters stay, so the two rotated AWS keys above read as ...0001 and ...0002 without exposing either.

Install, then init.

redacted init learns secrets from your .env, shows the config and asks before writing it, then registers the PostToolUse hook. Safe to run again.

curl recommended
$ curl -sSL https://raw.githubusercontent.com/svn-arv/redacted/main/install.sh | sh
Homebrew
$ brew tap svn-arv/tap
$ brew install redacted
Cargo
$ cargo install redacted-cli
$ redacted init Add --local to register the hook for this project only, or --env PATH to pick the env file.