Secret detection

Coding agents read .env files, dump environment variables and paste tokens into prompts. Secret detection scans every request on the gateway and flags, redacts or blocks credentials before they reach the model provider. No agent or CLI change is needed.

Available on the Team plan and above. Open Security in the console sidebar.

What is scanned

The gateway scans each request right after it authenticates the key, before routing, compression, debug-log capture or the provider call. Nothing downstream sees a redacted value: not the routing classifier, not debug logs, not the provider.

Scanned surfaces:

Not scanned or never modified:

• Model responses.
• Images, documents and other media blocks.
• Signed thinking / redacted_thinking blocks. Editing them would break the upstream call, so a hit there is reported as Flag with the reason Signed block.

Scanning is inline and fast: a 200 kB transcript scans in a few milliseconds, and history resent on the next turn is served from a cache.

Actions

Each hit gets one action:

A redacted value keeps its known prefix and the last four characters, e.g. sk_live_[REDACTED:stripe-live:a91f]. The replacement is deterministic: the same content yields the same output on every turn, so the provider prompt cache stays warm.

A blocked request returns:

{
  "error": {
    "type": "secret_detected",
    "rule_id": "aws-access-key",
    "message": "..."
  }
}

Defaults

When no action is set for a severity, the gateway uses:

A per-rule action overrides the severity action. A severity-level Block is downgraded to Flag for High-entropy string unless you set Block on that rule explicitly.

Modes

Start with Monitor to measure volume and false positives on real traffic, then switch to Enforce. Events recorded in Monitor show the reason Monitor mode.

Set up secret detection

Each section of the settings page saves on its own. A policy change applies to the full conversation history on the next request, which causes one prompt-cache miss for active sessions.

Built-in rules

Rules fall into three classes:

• Known formats: fixed prefixes such as AKIA or ghp_. Near-zero false positives.
• Keyword assignments: password=, api_key: and similar, with an entropy check on the value.
• High-entropy strings: random-looking values. Flag-only by default; the threshold scales with length.

Context rules

Context rules detect risky agent behavior rather than a value. They always Flag, whatever action is configured, and they are not file-access controls.

When enabled, a context rule also marks the linked tool result as sensitive, which lowers the keyword and entropy thresholds for values inside it. Disabling the rule removes both effects.

Custom rules

Add patterns for internal credential formats under Security → Secret detection → Custom rules. Custom rules run next to the built-in ones and accept the same per-rule actions, disabling and allowlists.

The redacted value is capture group 1 when the pattern has one, the whole match otherwise. Example:

\b(acme_[a-z0-9]{32})\b

Use Test against a sample to paste text and see what each rule would catch. Nothing is sent or saved.

Limits: 50 custom rules per organization. When matches overlap, precedence is known formats → custom rules → keyword assignment → high-entropy string. The gateway skips an invalid rule; it never fails a request because of one.

Allowlists and false positives

Three ways to silence a hit:

Marked false positives are listed under Secret detection → False positives, where admins can remove them.

Review detections

Security → Secrets shows summary counts (Detected, Critical, Redacted, Blocked) and the detection list with Time, Rule, Severity, Action, Surface, Value, Source, User and Session. Filter by period, severity, rule and action.

A session page also shows the secrets detected in that session.

Event semantics:

• One event per distinct value and rule in a request, with the strongest action applied (Block > Redact > Flag).
• Within a session, a value already reported is not reported again. Blocked requests always produce an event, including retries.
• Reason explains a downgraded action: Monitor mode, Signed block or Allowlisted path.

Limits

• Model responses are not scanned.
• count_tokens requests are redacted with the same policy but never blocked and produce no events.
• Cursor relay traffic and structured decision endpoints are not scanned.
• Secret detection reduces credential exposure; it does not replace secret scanning in your repositories or rotating a leaked credential.

Troubleshooting

Related: organization, sessions, debug logs.