Documentation
¶
Overview ¶
Package secrets masks sensitive environment-variable values so they don't leak from the inspect panel (screenshots, screen-shares) or to an AI model over MCP. Masking is policy applied above the docker layer, which always returns raw env; callers decide what the viewer is allowed to see.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsSensitive ¶
IsSensitive reports whether an env entry should be treated as a secret, by the variable name or by the shape of its value.
func MaskCommand ¶ added in v0.4.2
MaskCommand masks credential-looking tokens inside a container's command line, leaving the rest readable: a `--flag=value` / `KEY=value` whose name or value is sensitive, or a bare token that looks like a credential (sk-…, JWT, long token). A command is mostly non-secret, so only detected tokens are masked; "off" disables it. Heuristic — combined forms like `-psecret` aren't caught.
func MaskEnv ¶
MaskEnv returns a copy of env ("KEY=VALUE" entries) with values masked per mode. Entries without an '=' are passed through unchanged.
func MaskLabels ¶ added in v0.4.2
MaskLabels masks only label values that look sensitive (by name or value shape). Unlike env, label sets are mostly metadata (compose project, image version), so "all" is not applied wholesale — that would gut the inspect view.
Source Files