secretscan

Overview ¶

Package secretscan recognizes common secret shapes in free text.

It is deliberately conservative -- keyword and shape based -- so it does not mangle ordinary tool output or refuse ordinary prose. Nothing here proves text is safe: a scanner that found nothing has found nothing, not established that a string holds no credential. Both callers treat it that way. The run trace redacts what it recognizes and still bounds and scopes what it writes; project memory refuses a write it recognizes and still tells the agent that not persisting credentials is its own contract.

Grow the pattern set here rather than in either caller, so what the two recognize cannot drift apart.