What the default patterns recognize
The current skill targets recognizable formats for Anthropic, OpenAI, AWS, GitHub, Slack, Stripe, and Google credentials; JWTs; PEM private-key blocks; common Authorization headers; cookie headers and chains; InstaShare claim/delete tokens; and uppercase environment assignments ending in KEY, TOKEN, SECRET, PASSWORD, or PASSWD.
Matches are replaced with labels such as `[REDACTED:github-token]`. Surrounding transcript structure remains readable, which helps a recipient understand that a value existed without receiving the value itself.
What the scanner cannot promise
Pattern matching is best-effort, not data-loss prevention. It cannot recognize every proprietary token, a password written in ordinary prose, a customer identifier, confidential source code, an unusual cookie format, or a secret that does not resemble one of the curated patterns.
The scanner operates on text. It does not inspect screenshots or other image pixels, and it does not determine whether a filename, prompt, business plan, or tool result is confidential.
- Review the rendered share when the session touched sensitive systems.
- Add organization-specific patterns to your local skill when appropriate.
- Use an explicit confirmation or project blocklist for high-risk repositories.
- Do not treat a “no matches” result as proof that the transcript is safe.
Custom clients must provide their own redaction
Redaction is implemented by the documented skill, not as a blanket transformation applied to every API request. A direct curl command or custom integration can upload the original JSONL unchanged. The caller owns the preprocessing policy in those workflows.