--- id: scan-secrets-entropy track: coding version: 0.1.4 label: asks keyword: ask where: write turn-end sha256: 16b9ac55b9a285d30f0dfee0b3f44d20900cf2a739e383b43eeaecaae252aa62 source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/scan-secrets-entropy catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f --- # Review Values That Look Like Secrets scan-secrets-entropy · version 0.1.4 Asks — Asks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. In a git repo: at commit (Chock refuses the commit, locally and in CI.) ## What it does Friction, not a security boundary: asks a person before a write adds secrets scan-secrets misses -- high-entropy values (16-150 chars) by secret-like keys, GitHub/npm tokens with valid checksums, Stripe test keys, Slack/AWS key-id shapes, Luhn-valid cards. Asks a person (HP01 entropy is a heuristic, so it asks rather than blocks). Misses: values split across lines, over 150 chars, cut by # or & when unquoted, under other key names, written like code (a.b(), ALL_CAPS, words, URLs, paths), wrapped in a call, parens or concatenation, in XML, or padded with control characters. ## Its label on each agent - Claude Code (tested): Asks — Asks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=scan-secrets-entropy - Cursor (tested): Blocks — Refuses an agent's file writes and refuses at turn end, because this client cannot prompt at either point. Builder: /coding/builder/#client=cursor&p=scan-secrets-entropy - Codex (tested): Blocks — Refuses an agent's file writes and refuses at turn end, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=scan-secrets-entropy - GitHub Copilot (tested): Blocks — Refuses at turn end only, because this client cannot prompt there. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=scan-secrets-entropy - Devin (tested): Blocks — Refuses at turn end only, because this client cannot prompt there. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=scan-secrets-entropy - Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=scan-secrets-entropy - goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=scan-secrets-entropy - Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=scan-secrets-entropy - OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=scan-secrets-entropy - Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=scan-secrets-entropy - Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=scan-secrets-entropy ## What it misses Values split across lines, over 150 chars, cut by # or & when unquoted, under other key names, written like code (a.b(), ALL_CAPS, words, URLs, paths), wrapped in a call, parens or concatenation, in XML, or padded with control characters. ## Examples - Asks: A JSON config gains a client secret no vendor pattern names, as a quoted-colon pair. - Allowed: A config assigns a UUID to a service key. ## Latest change 0.1.4 · 2026-10-27 — Title wording only (IR-F40): "Scan Secrets Entropy" is now "Review Values That Look Like Secrets". The id, guard and tests are unchanged. ## Provenance - Tested by 25 of 25 cases run automatically - SHA-256: `16b9ac55b9a285d30f0dfee0b3f44d20900cf2a739e383b43eeaecaae252aa62` - Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f - Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/scan-secrets-entropy (catalog path `base/scan-secrets-entropy`) - Presets: Secrets - JSON: `/api/coding/policies/scan-secrets-entropy.json` - Report a problem: https://chock.sh/report/?policy=scan-secrets-entropy&version=0.1.4&page=%2Fcoding%2Fpolicies%2Fscan-secrets-entropy%2F