Docs / Secrets Guard

Secrets Guard

An add-on on the same @noeticguard/core engine — not a second SDK. Detects high-precision secret shapes in LLM egress (prompts, pasted code) and replaces them with reversible [SECRET_n] vault tokens.

On this page+

What it does

  • Runtime mask — Browser Shield and SDK when secrets_guard is in enabled_packs.
  • CLI scan — freemium scan flags secrets in repos (teaser even before purchase).
  • Merged with policy via mergeEnabledKindsWithPacks — same path as HIPAA / PCI presets.

Pattern families (v1)

  • OpenAI keys (sk-…, sk-proj-…)
  • Stripe live secret keys (sk_live_…)
  • Anthropic (sk-ant-…)
  • GitHub tokens (classic + fine-grained PAT, oauth/app/installation shapes)
  • GitLab / npm / PyPI / Hugging Face / SendGrid / Twilio / Shopify / Heroku / Doppler / DigitalOcean prefixed tokens
  • AWS access key ids (AKIA…)
  • Azure Storage AccountKey=… and Entra / Azure AD client-secret shapes (incl. tilde secrets)
  • Slack tokens (xoxb-, xoxp-, …)
  • JWT (validated header + payload)
  • PEM private key blocks
  • GCP service-account JSON snippet (type + private_key)
  • Context-gated assignments (AZURE_CLIENT_SECRET=, api_key=, access_token=, …)

Out of scope: live credential verification and broad “all API keys” claims. High-entropy gates reduce false positives on assignments and Azure keys.

Entitlement & CLI

Business+ includes Secrets Guard. On Startup, subscribe from Dashboard → Add-ons ($29/mo). Entitlement flows to GET /v1/config as enabled_packs. Raw secret values never appear in telemetry — only counts and token kinds.