You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[FEATURE]: secrets redaction at tool output boundary #32183
I have verified this feature I'm about to request hasn't been suggested before.
Tool output often contains API keys, tokens, and passwords that flow verbatim to the LLM and session history. A redaction layer at the tool output boundary would detect and redact secrets before they reach the model or get persisted.
Two detection strategies: pattern matching (ghp_, sk-, AKIA, etc.) and entropy scanning for unknown high-entropy tokens. Redacted values keep their prefix and structure so the model can still reason about credential usage without seeing the value. Session history and share links only store redacted content.
Thanks for updating the issue! It now meets the contributing guidelines — the title prefix, verification checkbox, and description are all in order. Removing the compliance flag.
Activity
github-actions commentedon Jun 13, 2026
This issue doesn't fully meet our contributing guidelines.
What needs to be fixed:
[FEATURE]:title prefix (e.g.,[FEATURE]: secrets redaction at tool output boundary)Please edit this issue to address the above within 2 hours, or it will be automatically closed.
This issue might be a duplicate of existing issues. Please check:
If you believe this was flagged incorrectly, please let a maintainer know.
[-]feat: secrets redaction at tool output boundary[/-][+][FEATURE]: secrets redaction at tool output boundary[/+]github-actions commentedon Jun 13, 2026
Thanks for updating the issue! It now meets the contributing guidelines — the title prefix, verification checkbox, and description are all in order. Removing the compliance flag.
MethodWhite commentedon Jun 13, 2026
Closing as duplicate of #19425. Left a design spec at https://github.com/MethodWhite/opencode/blob/spec-secrets-redaction/specs/secrets-redaction.md that may be useful for implementation.