{
  "schema_version": 1,
  "id": "scan-secrets-entropy",
  "track": "coding",
  "name": "Review Values That Look Like Secrets",
  "version": "0.1.4",
  "sha256": "16b9ac55b9a285d30f0dfee0b3f44d20900cf2a739e383b43eeaecaae252aa62",
  "sha256_v1": "4963aed6b256d2709d9e1e9e71fde638b04c6df07acbe3edaf6b6a9f30b61a53",
  "keyword": "ask",
  "word": "asks",
  "says": "asks on an agent's file writes and at turn end",
  "description": "Friction, not a security boundary: asks a person before a write adds secrets scan-secrets misses -- high-entropy values (16-150 chars) by secret-like keys, GitHub/npm tokens with valid checksums, Stripe test keys, Slack/AWS key-id shapes, Luhn-valid cards. Asks a person (HP01 entropy is a heuristic, so it asks rather than blocks). Misses: values split across lines, over 150 chars, cut by # or & when unquoted, under other key names, written like code (a.b(), ALL_CAPS, words, URLs, paths), wrapped in a call, parens or concatenation, in XML, or padded with control characters.",
  "misses": "values split across lines, over 150 chars, cut by # or & when unquoted, under other key names, written like code (a.b(), ALL_CAPS, words, URLs, paths), wrapped in a call, parens or concatenation, in XML, or padded with control characters.",
  "where": [
    "write",
    "turn-end"
  ],
  "groups": [
    "secrets"
  ],
  "eval_cases": 25,
  "eval_executed": 25,
  "latest": {
    "version": "0.1.4",
    "date": "2026-10-27",
    "change": "Title wording only (IR-F40): \"Scan Secrets Entropy\" is now \"Review Values That Look Like Secrets\". The id, guard and tests are unchanged."
  },
  "agent_labels": {
    "claude-code": {
      "keyword": "ask",
      "says": "asks on an agent's file writes and at turn end"
    },
    "cursor": {
      "keyword": "block",
      "says": "refuses an agent's file writes and refuses at turn end, because this client cannot prompt at either point"
    },
    "codex": {
      "keyword": "block",
      "says": "refuses an agent's file writes and refuses at turn end, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)"
    },
    "copilot": {
      "keyword": "block",
      "says": "refuses at turn end only, because this client cannot prompt there. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)"
    },
    "devin": {
      "keyword": "block",
      "says": "refuses at turn end only, because this client cannot prompt there. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed)"
    },
    "grok": {
      "keyword": "ungraded",
      "says": "Not graded yet for Grok"
    },
    "goose": {
      "keyword": "ungraded",
      "says": "Not graded yet for goose"
    },
    "antigravity": {
      "keyword": "ungraded",
      "says": "Not graded yet for Antigravity"
    },
    "openhands": {
      "keyword": "ungraded",
      "says": "Not graded yet for OpenHands"
    },
    "kimi-code": {
      "keyword": "ungraded",
      "says": "Not graded yet for Kimi Code"
    },
    "factory-droid": {
      "keyword": "ungraded",
      "says": "Not graded yet for Factory Droid"
    }
  },
  "source_url": "https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/scan-secrets-entropy",
  "enforces": "enforced-at-commit",
  "examples": [
    {
      "word": "Asks",
      "prompt": "A JSON config gains a client secret no vendor pattern names, as a quoted-colon pair.",
      "command": null
    },
    {
      "word": "Allowed",
      "prompt": "A config assigns a UUID to a service key.",
      "command": null
    }
  ]
}